---
title: "Preview Shared Account Exposure"
method: GET
path: "/api/integrations/instances/{instance_id}/share-preview/{library_id}"
tags: ["integrations"]
---

# Preview Shared Account Exposure

`GET /api/integrations/instances/{instance_id}/share-preview/{library_id}`

## Request

- Base URL: `https://app.thinqos.com` (the document declares no server; this is the origin it was published from)
- URL: `https://app.thinqos.com/api/integrations/instances/{instance_id}/share-preview/{library_id}`
- Auth: none declared

The blast-radius facts for sharing ``instance_id``'s account into a group.

READ ONLY. Mutates nothing, and returns exactly the body the 409 guard
returns, so the "How should members connect?" screen renders the SERVER's
member count, audit identity and blast-radius sentence instead of inventing
them client-side or -- worse -- discovering them by firing a mutation it
hopes will be refused.

That "hope it is refused" shape is not hypothetical: without a preview the
only way to learn the facts is to attempt the share unconfirmed, which
SUCCEEDS whenever the guard does not fire (a single-member group), silently
performing the very operation the screen was about to ask permission for.

Authorization is the destination's own configure rung -- the same authority
the move itself requires -- because the body names the destination's members
and their identity ids. Answering it to a caller who could not perform the
move would be a membership disclosure.

## Path parameters

- `instance_id` string, uuid, required
- `library_id` string, uuid, required

## Headers

- `x-impersonate-identity-id` string, nullable

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/thinqos/apis/thinqos-api.md) · [All operations](https://skmtc.dev/thinqos/apis/thinqos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thinqos/apis/thinqos-api/revisions/ce2c2ce318b1?raw)