Share a file or folder with one person by email

Admin, or the folder's manager for a folder. Only the role is relaxed for a manager: every share needs the external-sharing entitlement (Teams/Enterprise, or the collab.external_sharing feature on self-host; 403 EXTERNAL_SHARING_NOT_ENTITLED) and an email the workspace's allowed domains or emails accept (403 DOMAIN_NOT_ALLOWED). Invites an external user if needed and mints an external_user grant; re-sharing is idempotent and replaces the expiry. For a folder, the invite email's join link carries ?folder=<id> through sign-in and lands on /shared?folder=<id> (that folder's branded portal); an already-active person's email links there too. Returns 409 if the email is already an internal member. With guest: true (folders only) no account is created: a guest grant whose subject is the email itself, and an emailed link that opens the folder in a space-guest session. The guest can also open it from /shared?folder=<id> with an email code. They see that folder's subtree only, up to the capability; revoking or expiring the grant ends their session on the next request.