Share a private artifact with the confirmed organization

Owner only. JSON body { "accessType": "org_shared", "organizationId": "<current organization id>" } switches a private artifact to org_shared and sets organizationId to that id. The id must be the caller’s current membership. The only explicit row lock is the artifact. The organization foreign-key check takes an implicit KEY SHARE lock on the organization row. The update does not lock the user, the session, or membership rows. It re-checks membership and, for a session, that the session is still present and unexpired, in the conditional UPDATE. That statement is the linearization point. A different current organization at that snapshot is 409 ORGANIZATION_CHANGED and does not write. A membership removal, organization deletion, active-organization change, or session revocation that commits before the statement reads its rows returns 409, 400, or 401 UNAUTHENTICATED with no write. An authorization change that commits after that snapshot can land before the transaction commits and does not cancel the share. A deadlock, serialization failure, or lock timeout retries once and then returns 409 ORGANIZATION_CHANGED with no write. About 16 seconds is the budget for those two attempts, not a deadline for this endpoint. The update matches the id, the creator, and accessType private, so concurrent requests leave one organization-shared row. An artifact that is already org_shared returns 200 and does not change its organization, share token, or share password, for any confirmed organizationId and whether or not the caller has a current organization. This route does not create or remove a public share, and it does not change an organization-shared artifact back to private. Cookie-authenticated writes need Origin or Referer to be WEB_ORIGIN or PUBLIC_BASE_URL.

PATCH /api/v1/artifacts/{id}

200

{
  "artifact": {
    "id": "11111111-1111-4111-8111-111111111111",
    "creatorUserId": "user_example",
    "organizationId": "org_example",
    "accessType": "org_shared",
    "filename": "11111111-1111-4111-8111-111111111111.html",
    "name": "hello",
    "mimeType": "text/html",
    "sizeBytes": 527,
    "createdAt": "2026-10-21T12:00:00.000Z",
    "updatedAt": "2026-10-21T12:00:00.000Z",
    "uploadedAt": "2026-10-21T12:00:00.000Z",
    "viewerUrl": "http://localhost:3000/artifacts/11111111-1111-4111-8111-111111111111",
    "contentUrl": "http://localhost:3001/api/v1/artifacts/11111111-1111-4111-8111-111111111111/content",
    "shared": false,
    "passwordProtected": false
  }
}

Authorizations

bearerAuthsessionCookie

Authorization · string · header · required

Factrove API key, usually prefixed ftrv_. Send Authorization: Bearer <key>. Product routes do not accept x-api-key as a credential. A present Authorization header that is not a valid key does not fall back to the session cookie.

Path Parameters

id · string<uuid> · required

Artifact UUID.

Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$

Body

application/json

Share the artifact with the organization the caller confirmed. That id must be the current membership.

accessType · string · required

Allowed value: "org_shared"

organizationId · string · required

Minimum string length: 1

Response

200

application/json

The artifact is org_shared. A repeat request for an artifact that is already org_shared returns it without writing, for any confirmed organizationId.

artifact · object · required

Show child attributes