---
title: "Create a scoped share link"
method: POST
path: "/v1/spaces/{spaceId}/share-links"
tags: ["Access"]
---

# Create a scoped share link

`POST /v1/spaces/{spaceId}/share-links`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/spaces/{spaceId}/share-links`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Creates a stable visitor link that opens only its configured path scopes. Capabilities default to view-only. A link with `comments.write` must target where Comments run: while the Space's comments surface is `previews` (the default), target a Version, branch, or all Versions; a live target needs the surface set to `everywhere`. Otherwise 422 `comments_target_unavailable`.

## Path parameters

- `spaceId` string, required

## Request body

- object
  - `name` string, required
  - `landingPath` string
  - `resources` object, required
    - `include` string[], required
    - `exclude` string[]
  - `capabilities` string[]
  - `constraints` object
    - `notBefore` union
      - string, date-time
      - string
    - `expiresAt` union
      - string, date-time
      - string
    - `maxUses` integer
    - `requireVerifiedEmail` boolean
    - `network` object
      - `ipCidrs` string[]: IP address and CIDR Grants are unsupported because the serving runtime has no trusted visitor IP. Remove the IP constraint.
      - `countries` string[]
      - `excludedCountries` string[]
      - `excludedUserAgentSubstrings` string[]
    - `frameOrigin` string
  - `target` union
    - object
      - `kind` 'live', required
    - object
      - `kind` 'version', required
      - `versionId` string, required
    - object
      - `kind` 'branch', required
      - `branch` string, required
    - object
      - `kind` 'all_versions', required

## Response `201`

Response for status 201

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` object, required
    - `id` string, required
    - `spaceId` string, required
    - `grantId` string, required
    - `revision` integer, required
    - `name` string, required
    - `landingPath` string, required
    - `resources` object, required
      - `include` string[], required
      - `exclude` string[], required
    - `capabilities` string[], required
    - `constraints` object, required
      - `notBefore` union
        - string, date-time
        - string
      - `expiresAt` union
        - string, date-time
        - string
      - `maxUses` integer
      - `requireVerifiedEmail` boolean
      - `network` object
        - `ipCidrs` string[]: IP address and CIDR Grants are unsupported because the serving runtime has no trusted visitor IP. Remove the IP constraint.
        - `countries` string[]
        - `excludedCountries` string[]
        - `excludedUserAgentSubstrings` string[]
      - `frameOrigin` string
    - `target` union, required
      - object
        - `kind` 'live', required
      - object
        - `kind` 'version', required
        - `versionId` string, required
      - object
        - `kind` 'branch', required
        - `branch` string, required
      - object
        - `kind` 'all_versions', required
    - `createdBy` string, nullable, required
    - `openCount` integer, required
    - `lastUsedAt` string, date-time, nullable, required
    - `revokedAt` string, date-time, nullable, required
    - `createdAt` string, date-time, required
    - `active` boolean, required
    - `url` string, uri, required

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)