> ## Documentation Index
> Fetch the complete documentation index at: https://help.abacusdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Issue a direct-share link

> Create a direct-share link for a schema or batch.

Mints a token for a schema or a batch. For a batch the acceptance is full edit access. The secret is the token — treat it like a key.


## OpenAPI

````yaml POST /api/v2/library/share/links/
openapi: 3.1.0
info:
  title: Abacus Docs API
  version: 1.0.0
  description: |
    REST + SSE surface for Abacus Docs on the same host as the web app
    (`https://abacusdocs.com`). Paths are `/api/v2/…`.

    Authenticate with an organisation API key (`sk-abacus-*`) as a Bearer
    token, or an Auth0 access token. Cross-tenant reads return **404**, not
    403. Page-based lists use `?page=` and `?page_size=`.

    Extraction, reprocess, schema tests, and chat turns spend credits.
    See the help centre Credits pages for rates.
  contact:
    name: Abacus Docs
    url: https://abacusdocs.com/contact
servers:
  - url: https://abacusdocs.com
    description: Production (Extract)
security: []
paths:
  /api/v2/library/share/links/:
    post:
      tags:
        - v2/library
      summary: Issue a direct-share link for a Struct or Batch
      description: >-
        Creates a fresh :class:`DirectShareLink` row. Owner-only — the requester
        must be the item's ``created_by`` OR a mod / superuser (Decision 26).
        Returns the new row including the token + the fully-qualified
        token-landing URL.
      operationId: v2_library_share_links_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DirectShareLinkRequestRequest'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DirectShareLink'
          description: ''
        '400':
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
          description: ''
        '403':
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
          description: ''
        '404':
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
          description: ''
      security:
        - extractApiKey: []
        - bearerAuth: []
        - cookieAuth: []
components:
  schemas:
    DirectShareLinkRequestRequest:
      type: object
      description: |-
        Input for ``POST /api/v2/library/share/links/``.

        The view resolves ``(content_type, object_id)`` to a concrete
        ``Struct`` or ``Batch`` instance, enforces org-match + owner-or-mod
        semantics, and inserts the link row. This serializer just validates
        input shape.
      properties:
        content_type:
          $ref: '#/components/schemas/ContentTypeEnum'
        object_id:
          type: integer
          minimum: 1
        note:
          type: string
          maxLength: 500
      required:
        - content_type
        - object_id
    DirectShareLink:
      type: object
      description: |-
        Output projection for a :class:`DirectShareLink` row.

        Composed for the list endpoint (owner-side roster) and as the
        response body of every mutation endpoint.

        The ``acceptances`` field carries the roster — recipients do NOT see
        other users' acceptances (Decision 33), so the view layer is
        responsible for nulling this out (or using a different serializer
        class entirely) on recipient-facing endpoints.

        The ``url`` field is the fully-qualified token-landing URL, built
        from the request's ``build_absolute_uri`` when available. Falls back
        to a relative path otherwise.
      properties:
        id:
          type: integer
          readOnly: true
        content_type:
          type: string
          readOnly: true
        object_id:
          type: integer
          readOnly: true
        content_object_summary:
          oneOf:
            - $ref: '#/components/schemas/_DirectShareContentObjectSummary'
            - type: 'null'
          readOnly: true
        token:
          type: string
          readOnly: true
        url:
          type:
            - string
            - 'null'
          readOnly: true
        created_by:
          oneOf:
            - $ref: '#/components/schemas/_DirectShareActor'
            - type: 'null'
          readOnly: true
        created_at:
          type: string
          format: date-time
          readOnly: true
        revoked_at:
          type:
            - string
            - 'null'
          format: date-time
          readOnly: true
        revoked_by:
          oneOf:
            - $ref: '#/components/schemas/_DirectShareActor'
            - type: 'null'
          readOnly: true
        is_revoked:
          type: boolean
          readOnly: true
        note:
          type: string
          readOnly: true
        acceptances:
          type: array
          items:
            $ref: '#/components/schemas/DirectShareAcceptance'
          readOnly: true
      required:
        - acceptances
        - content_object_summary
        - content_type
        - created_at
        - created_by
        - id
        - is_revoked
        - note
        - object_id
        - revoked_at
        - revoked_by
        - token
        - url
    ContentTypeEnum:
      enum:
        - struct
        - batch
      type: string
      description: |-
        * `struct` - struct
        * `batch` - batch
    _DirectShareContentObjectSummary:
      type: object
      description: >-
        Tiny shape: just enough to render a share row in the UI.


        Mirrors
        :class:`deckmonkey.api_v2.library.serializers._ContentObjectSummarySerializer`

        so the SPA's orval client gets a stable shape between org-library

        and direct-share surfaces. For ``Struct`` rows: ``{"id", "slug",

        "name", "status", "kind"}``; for ``Batch`` rows: ``{"id", "name",

        "status", "kind"}``.


        Named with a ``_DirectShare`` prefix to avoid a drf-spectacular

        component-name collision with the org-library serializer of the

        same role (same shape, but spectacular keys components by Python

        class name).
      properties:
        id:
          type: integer
        kind:
          type: string
        name:
          type: string
        slug:
          type: string
        status:
          type: string
      required:
        - id
        - kind
        - name
    _DirectShareActor:
      type: object
      description: |-
        Compact user projection for ``created_by`` / ``revoked_by``
        / ``accepted_by``.

        Named with a ``_DirectShare`` prefix to avoid a drf-spectacular
        component-name collision with
        :class:`deckmonkey.api_v2.library.serializers._ActorSerializer`.
      properties:
        id:
          type:
            - integer
            - 'null'
        email:
          type:
            - string
            - 'null'
          format: email
      required:
        - id
    DirectShareAcceptance:
      type: object
      description: |-
        Output projection for a single :class:`DirectShareAcceptance` row.

        Used as a roster element inside :class:`DirectShareLinkSerializer`
        (owner-side roster on the link detail) AND as the response body of
        the recipient-side accept / remove endpoints (so the SPA can update
        its local cache from the response without a follow-up GET).
      properties:
        id:
          type: integer
          readOnly: true
        link_id:
          type: integer
          readOnly: true
        accepted_by:
          oneOf:
            - $ref: '#/components/schemas/_DirectShareActor'
            - type: 'null'
          readOnly: true
        accepted_at:
          type: string
          format: date-time
          readOnly: true
        removed_at:
          type:
            - string
            - 'null'
          format: date-time
          readOnly: true
        is_active:
          type: boolean
          readOnly: true
      required:
        - accepted_at
        - accepted_by
        - id
        - is_active
        - link_id
        - removed_at
  securitySchemes:
    extractApiKey:
      type: http
      scheme: bearer
      bearerFormat: API Key
      description: |
        Organisation API key from Settings → API / `/api/keys/`. The secret is
        shown once. Send `Authorization: Bearer sk-abacus-…`. One active key
        per organisation. Ingest (`/api/v2/ingest/*`) refuses API keys — that
        surface is Auth0-only with `ingest:read` / `ingest:write` scopes.
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >
        Auth0 access token for a signed-in user. Send `Authorization: Bearer
        <token>`.

        The SPA and desktop agent use this. Prefer an organisation API key for

        server-to-server integrations.
    cookieAuth:
      type: apiKey
      in: cookie
      name: sessionid
      description: |
        Django session cookie from a browser login. Present so the web app can
        call `/api/v2` without a header. Do not rely on this for integrations.

````