> ## Documentation Index
> Fetch the complete documentation index at: https://help.abacusdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Accept a direct-share link

> Accept a direct-share token as the recipient.

Recipient. Mints the `DirectShareAcceptance` that **is** the grant (full batch edit, schema view). A foreign or spent token is **404**.


## OpenAPI

````yaml POST /api/v2/library/share/links/by-token/{token}/accept/
openapi: 3.1.0
info:
  title: Abacus Docs API
  version: 1.0.0
  description: |
    REST + SSE surface for Abacus Docs on the same host as the web app
    (`https://abacusdocs.com`). Paths are `/api/v2/…`.

    Authenticate with an organisation API key (`sk-abacus-*`) as a Bearer
    token, or an Auth0 access token. Cross-tenant reads return **404**, not
    403. Page-based lists use `?page=` and `?page_size=`.

    Extraction, reprocess, schema tests, and chat turns spend credits.
    See the help centre Credits pages for rates.
  contact:
    name: Abacus Docs
    url: https://abacusdocs.com/contact
servers:
  - url: https://abacusdocs.com
    description: Production (Extract)
security: []
paths:
  /api/v2/library/share/links/by-token/{token}/accept/:
    post:
      tags:
        - v2/library
      summary: Accept a direct-share link (recipient-side)
      description: >-
        Idempotent upsert: creates a fresh :class:`DirectShareAcceptance` row
        for ``(link, request.user)``, or clears ``removed_at`` on the existing
        row when the recipient previously removed it from their list (Decision
        24 — re-open re-activates). Same-org gate: the user must be in the same
        org as the link's owner; cross-org tokens 404 (Decision 16). Revoked
        links 404.
      operationId: v2_library_share_links_by_token_accept_create
      parameters:
        - in: path
          name: token
          schema:
            type: string
          required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DirectShareAcceptance'
          description: ''
        '404':
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
          description: ''
      security:
        - extractApiKey: []
        - bearerAuth: []
        - cookieAuth: []
components:
  schemas:
    DirectShareAcceptance:
      type: object
      description: |-
        Output projection for a single :class:`DirectShareAcceptance` row.

        Used as a roster element inside :class:`DirectShareLinkSerializer`
        (owner-side roster on the link detail) AND as the response body of
        the recipient-side accept / remove endpoints (so the SPA can update
        its local cache from the response without a follow-up GET).
      properties:
        id:
          type: integer
          readOnly: true
        link_id:
          type: integer
          readOnly: true
        accepted_by:
          oneOf:
            - $ref: '#/components/schemas/_DirectShareActor'
            - type: 'null'
          readOnly: true
        accepted_at:
          type: string
          format: date-time
          readOnly: true
        removed_at:
          type:
            - string
            - 'null'
          format: date-time
          readOnly: true
        is_active:
          type: boolean
          readOnly: true
      required:
        - accepted_at
        - accepted_by
        - id
        - is_active
        - link_id
        - removed_at
    _DirectShareActor:
      type: object
      description: |-
        Compact user projection for ``created_by`` / ``revoked_by``
        / ``accepted_by``.

        Named with a ``_DirectShare`` prefix to avoid a drf-spectacular
        component-name collision with
        :class:`deckmonkey.api_v2.library.serializers._ActorSerializer`.
      properties:
        id:
          type:
            - integer
            - 'null'
        email:
          type:
            - string
            - 'null'
          format: email
      required:
        - id
  securitySchemes:
    extractApiKey:
      type: http
      scheme: bearer
      bearerFormat: API Key
      description: |
        Organisation API key from Settings → API / `/api/keys/`. The secret is
        shown once. Send `Authorization: Bearer sk-abacus-…`. One active key
        per organisation. Ingest (`/api/v2/ingest/*`) refuses API keys — that
        surface is Auth0-only with `ingest:read` / `ingest:write` scopes.
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >
        Auth0 access token for a signed-in user. Send `Authorization: Bearer
        <token>`.

        The SPA and desktop agent use this. Prefer an organisation API key for

        server-to-server integrations.
    cookieAuth:
      type: apiKey
      in: cookie
      name: sessionid
      description: |
        Django session cookie from a browser login. Present so the web app can
        call `/api/v2` without a header. Do not rely on this for integrations.

````