Unlock a password-protected share

No session. JSON { password }. A matching password returns { grant: { token, expiresAt } } valid for 15 minutes. A link with no password returns { grant: null }. A wrong password is 401 PASSWORD_INCORRECT. An inactive link is 404 ARTIFACT_NOT_FOUND. A missing or non-JSON body is 400 INVALID_REQUEST before any password throttle is charged. Client failures allow 10 per 10 minutes. Share failures allow 30 per 10 minutes, charged only after a wrong password. An exhausted share is 429 RATE_LIMITED with Retry-After and no hash verification. A saturated Argon2 gate, or a share whose remaining slots are all in flight, is 503 UNLOCK_UNAVAILABLE with Retry-After. This route ignores a leftover session cookie and does not apply the cookie origin guard.

POST /api/v1/public/artifacts/{id}/{token}/unlock

200

{
  "grant": {
    "token": "g1.example",
    "expiresAt": "2026-10-21T12:15:00.000Z"
  }
}

Path Parameters

id · string<uuid> · required

Artifact UUID.

Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$

token · string · required

Public share token from the owner share URL. The stored column is a hash, not this value.

Minimum string length: 1

Body

application/json

The link password.

password · string · required

Required string length: 1 - 1024

Response

200

application/json

A grant for a protected link, or null when the link has no password.

grant · object | null · required

Show child attributes