Read a public share

No session. The response omits creator, organization, access type, and the share URL. An inactive, unknown, or revoked token is 404 ARTIFACT_NOT_FOUND and does not say whether the artifact exists. A password-protected share without a valid X-Factrove-Share-Grant is 401 PASSWORD_REQUIRED. The view allowance is charged per visitor address before the link lookup and password check, so a 401 or 404 still consumes it. IPv6 addresses share a /64. A charge grants two companion content loads for 30 seconds. View units are limited to 60 per 60 seconds per client address, in memory on each API process. A content request without a remaining companion charges another view unit before its own lookup. That 429 does not include Retry-After. Responses send Referrer-Policy: no-referrer and X-Robots-Tag: noindex.

GET /api/v1/public/artifacts/{id}/{token}

200

{
  "artifact": {
    "id": "11111111-1111-4111-8111-111111111111",
    "filename": "11111111-1111-4111-8111-111111111111.html",
    "name": "hello",
    "mimeType": "text/html",
    "sizeBytes": 527,
    "uploadedAt": "2026-10-21T12:00:00.000Z",
    "contentUrl": "http://localhost:3001/api/v1/public/artifacts/11111111-1111-4111-8111-111111111111/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/content",
    "passwordProtected": false
  }
}

Headers

x-factrove-share-grant · string

Unlock grant from POST /unlock. Never a cookie and never part of a URL. The HTTP header is X-Factrove-Share-Grant.

Path Parameters

id · string<uuid> · required

Artifact UUID.

Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$

token · string · required

Public share token from the owner share URL. The stored column is a hash, not this value.

Minimum string length: 1

Response

200

application/json

Public artifact metadata. contentUrl may include a short-lived ticket query after a grant.

artifact · object · required

Show child attributes