assets

Change who can read a file

Set who this file is shared with: private (only the person who added it, plus workspace admins), team (everyone in the workspace, the default), or external (the workspace, and it may also be shared outside through a link). Sending the same level twice leaves the same state. Widening to 'Anyone with the link' opens every live link to the file for outsiders, including links colleagues created earlier.

Only the person who ADDED the file may change this, plus workspace admins — everyone else gets a 403 saying so, not a 404: they can already see the file, so pretending it is missing would be the confusing answer. A 404 here means the file does not exist, has been removed, belongs to another workspace, or is somebody else's private file.

Setting a file to private FROM another level also REVOKES every share link whose revoked_at is still empty, including a link that already expired. A file that is already private KEEPS the links it has: a private file has an address like any other, and the revoke fires on the transition INTO private, not on the level, so re-sending private revokes nothing and answers revoked_share_links: 0. Use DELETE /assets/{id}/share-links/{link_id} to close one of them. Narrowing to team revokes none of them: a link is an address, so those URLs keep opening for the people the new level admits and stop opening for everybody else, except an external-minted file token can still open through a folder with a live folder link. private is the one level that ends the links themselves, and it ends them for the file's own author too. Revoking rather than pausing is deliberate — 'Only me' is the off-switch people reach for, so widening the file again must not re-arm a URL somebody believed they had killed. Share the file again with a new link instead. Read GET /assets/{id}/share-links first if you need to tell somebody what they are about to switch off.

put/v1/assets/{asset_id}/visibility

Request

Base URL: https://api.patricia.app (the document declares no server; this is the origin it was published from)
URL: https://api.patricia.app/v1/assets/{asset_id}/visibility
Auth: HTTP bearer

Path parameters

asset_idstring uuid required

The asset's id.

Headers

X-Tenant-Idstring nullable

Request body

level'private' | 'team' | 'external' required

Who should be able to read this file from now on.

Response

Successful Response

idstring uuid required

namestring required

The workspace's handle for the file. UNTRUSTED text: render escaped.

category'document' | 'media' | 'app' required

Which library this file lives in: 'document' or 'media'.

What sort of file this is.

content_typestring required

The current version's media type, e.g. 'application/pdf'.

byte_sizeinteger required

The current version's size in bytes.

current_versioninteger required

The newest version number (versions count from 1).

updated_atstring date-time required

When the file last changed (UTC).

created_by_run_idstring uuid nullable

The Patricia run that created this file. Null when no run is recorded for it: a person uploaded it, or it was stored before Patricia began recording runs. Later versions can come from other runs, so read each version's own created_by_run_id for those.

favoriteboolean nullable

Whether the workspace marked this file a favourite (the Liked filter shows these). The server always sends it; the default exists for the same temporary fixture-compatibility reason the module docstring records for created_by_run_id.

thumbnail_status'ready' | 'pending' | 'unavailable'

Whether this file has a grid preview. 'ready' means GET /assets/{id}/thumbnail serves it; 'pending' means one is being prepared, ask again shortly; 'unavailable' means the type icon is the answer (no preview exists for this file type, or this file could not be rendered).

created_atstring date-time

When the file was first added to the workspace (UTC).

is_ownerboolean

Whether the caller is the person who owns this file.

requires_access_acknowledgementboolean

Whether opening this file requires an access_acknowledgement UUID and a durable audit receipt.

visibility'private' | 'team' | 'external'

Who can read this file. 'private' — only the person who added it, plus workspace admins. 'team' — everyone in the workspace (the default). 'external' — everyone in the workspace, and it may also be shared outside through a link. A file you can see at all is one you may read; the level tells you who ELSE can.

shared_via_folder_namestring nullable

The name of the folder making this file reachable beyond its own visibility level, when a live folder share link is why — for a private file, why anybody else in the workspace can read it; for any file, why anybody outside the workspace holding that folder's link can too. Null when no folder link is why this file is reachable.

can_editboolean

Whether YOU may change this file: save a new version, restore an older one, rename it, or move it to another folder. Computed server-side by the same may_mutate rule every mutation route enforces, so a control enabled by this flag is never refused by that request. A shared folder can make a private file READABLE without making it EDITABLE, so this answers the write question on its own — never inferred from visibility or from shared_via_folder_name.

can_open_in_canvaboolean

Whether YOU may open this media file as a Canva design. Requires edit access to THIS file, a supported image type, a live Canva connection, and the Canva provider in this deployment. Edit access is the same per-file rule this row reports as can_edit, because sending a file out to a third-party account is an export. Computed server-side by the same rule POST /assets/{id}/canva-design enforces, so a menu item enabled by this flag is never refused by that request.

Changes

No recorded changes to this operation across all 1 revision of this API.