Shares - Aquila

A share link shows one resource to anyone with the link. No login needed. The link carries a random token. The token is the credential.

Mint a link

POST /api/{resource}/{id}/share works for three resource types: leads, js-monitoring, and js-analysis.

curl -X POST https://aquila.attaxr.com/api/leads/lead_1/share \
  -H "x-api-key: aquila_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

An empty body uses the default lifetime. The response carries the share record with its token and expiry.

Manage

GET /api/{resource}/{id}/share — the active share, or 404.
DELETE /api/{resource}/{id}/share — revoke. Revoking twice is safe.

The public endpoint

GET /api/public/{resourceType}/{token} resolves a share without a session:

curl https://aquila.attaxr.com/api/public/lead/SHARE_TOKEN

The endpoint resolves exactly one share document, and the document resolves one resource owned by the sharer. A token can never surface a resource its creator does not own. Responses send Cache-Control: no-store.