---
title: "Shared Recording Media"
method: GET
path: "/r/{token}/media"
tags: ["report-share"]
---

# Shared Recording Media

`GET /r/{token}/media`

## Request

- Base URL: `https://api-v1.unusual.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api-v1.unusual.ai/r/{token}/media`
- Auth: none declared

Per-view media credential for a ``call_recording`` share: re-validate
the share and its gate, then 302 to a FRESH short-lived presigned R2 URL.
The player shell served at ``/r/{token}`` points here, so the link a
client holds is the revocable token while the bearer credential under it
is minted per request (design: ``backend/external_share/recordings.py``).

Lookup is ``get_share_gate_facts`` (side-effect-free, no
``rendered_html`` — the full frozen page must not ride along on every
hit of an unauthenticated route), NOT ``load_share`` — the page render
is the genuine first "open" and a media fetch must not stamp
``first_opened_at``. Successful redirects DO record a view (throttled by
``record_view``'s per-viewer window): the media URL is copyable out of
the shell, so media-only watchers must not be invisible to the view log
and the first-open ping. Every failure mode is a uniform, no-store 404:
an unauthenticated probe learns nothing about token existence, kind,
gate mode, or revocation state.

Gate honoring mirrors the page: the gate cookie is path-scoped to
``/r/{token}``, which RFC 6265 path-matching also sends to this sub-path.

## Path parameters

- `token` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/unusual/apis/dashboard-server.md) - [All operations](https://skmtc.dev/unusual/apis/dashboard-server/llms.txt) - [OpenAPI document](https://skmtc.dev/unusual/apis/dashboard-server/revisions/89f716930ead?raw)