> ## Documentation Index > Fetch the complete documentation index at: https://docs.myrqen.cc/llms.txt > Use this file to discover all available pages before exploring further. # Create a share link > Only the report **owner** may create a share, and the slug is returned exactly once. Anonymous access is honoured only when the mode is `anyone_with_link`. Active shares per report are capped by plan: 5 on free, 25 on pro, 100 on team, 1000 on enterprise. ## OpenAPI ````yaml /api-reference/openapi.json post /api/v1/reports/{id}/shares openapi: 3.1.0 info: title: Myrqen API version: 1.0.0 description: >- The JSON API served by `apps/web` under `/api/v1`. Derived from the route handlers in `apps/web/app/api/v1` and the shared types in `packages/contracts`. This reference documents the surface a developer and the Myrqen CLI actually use. Platform-administration and billing endpoints exist in the application but are operator-only and are deliberately not published here. The hosted service at `https://api.myrqen.cc` is not deployed yet. Run your own deployment and use its origin. license: name: Myrqen Source-Available Licence 1.0 url: https://github.com/stijnswapped/Myrqen/blob/main/LICENSE servers: - url: http://localhost:3000 description: >- A deployment you run yourself. Use this while the hosted service is unavailable. - url: https://api.myrqen.cc description: >- The hosted API. This is the CLI's shipped default, but the hosted service is NOT deployed yet, so requests to it do not resolve today. security: [] tags: - name: Health description: >- Liveness and readiness probes. Unauthenticated, and answered on any hostname. - name: Authentication description: Browser sessions. Password plus recovery codes; no email is ever sent. - name: Device linking description: Binding a machine's CLI to an account, via browser approval. - name: Workspaces and projects description: Where a scanned repository belongs. - name: Sync and quota description: Creating, feeding, and finalizing a cloud report. - name: Reports description: Reading and exporting a synced report. - name: Sharing description: Share links and the server-side projections they resolve to. - name: Analytics description: Allowlisted product-event ingest. - name: Updates description: The signed release manifest. paths: /api/v1/reports/{id}/shares: post: tags: - Sharing summary: Create a share link description: >- Only the report **owner** may create a share, and the slug is returned exactly once. Anonymous access is honoured only when the mode is `anyone_with_link`. Active shares per report are capped by plan: 5 on free, 25 on pro, 100 on team, 1000 on enterprise. operationId: createShare parameters: - $ref: '#/components/parameters/ReportId' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateShareRequest' responses: '201': description: Created. `slug` and `url` are shown once. content: application/json: schema: type: object required: - shareId - slug - url properties: shareId: type: string slug: type: string url: type: string format: uri '400': $ref: '#/components/responses/BadRequest' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/ValidationFailed' security: - sessionCookie: [] components: parameters: ReportId: name: id in: path required: true schema: type: string description: The cloud report id. schemas: CreateShareRequest: type: object required: - mode - defaultPolicy properties: mode: $ref: '#/components/schemas/ShareMode' password: type: string expiresAt: type: string format: date-time anonymousAllowed: type: boolean description: Honoured only when `mode` is `anyone_with_link`. defaultPolicy: $ref: '#/components/schemas/ProjectionPolicy' principals: type: array items: $ref: '#/components/schemas/SharePrincipalRuleInput' ShareMode: type: string enum: - private - workspace - account_allowlist - unlisted - anyone_with_link ProjectionPolicy: type: object required: - version - sections - findings - fields description: >- A typed, testable projection rule set. Deliberately not a programmable policy language. properties: version: type: integer const: 1 sections: type: object required: - mode - ids properties: mode: type: string enum: - allow_all - allow_only ids: type: array items: type: string enum: - metadata - summary - findings - coverage - limitations - methodology findings: type: object required: - mode - ids properties: mode: type: string enum: - allow_all - allow_only ids: type: array items: type: string maxSeverity: $ref: '#/components/schemas/Severity' fields: type: object description: Masks applied to what remains. `true` masks the field. properties: evidence: type: boolean code: type: boolean reproduction: type: boolean remediation: type: boolean metadata: type: boolean anonymize: type: boolean SharePrincipalRuleInput: type: object required: - principalType - policy properties: principalType: type: string enum: - user - email - workspace - anonymous principalValue: type: string description: User id, normalized email, or workspace id. Unused for `anonymous`. label: type: string policy: $ref: '#/components/schemas/ProjectionPolicy' ApiError: type: object required: - error properties: error: type: object required: - code - message - requestId properties: code: $ref: '#/components/schemas/ApiErrorCode' message: type: string description: Human-readable. May change; branch on `code`. requestId: type: string description: A fresh UUID per response, for correlating with server logs. details: type: object additionalProperties: true example: error: code: SYNC_WEEKLY_LIMIT_REACHED message: Cloud report limit reached. This scan stays local. requestId: 8f14e45f-ceea-467a-9f8b-2b6b2b6a1f2c details: weekly: used: 15 limit: 15 resetsAt: '2026-08-24T06:00:00.000Z' Severity: type: string enum: - critical - high - medium - low - info ApiErrorCode: type: string enum: - BAD_REQUEST - VALIDATION_FAILED - UNAUTHENTICATED - FORBIDDEN - NOT_FOUND - CONFLICT - RATE_LIMITED - INTERNAL - DEVICE_LINK_EXPIRED - DEVICE_LINK_ALREADY_CONSUMED - DEVICE_LINK_NOT_APPROVED - DEVICE_REVOKED - SYNC_DAILY_LIMIT_REACHED - SYNC_WEEKLY_LIMIT_REACHED - REPORT_EXPIRED - REPORT_SCHEMA_UNSUPPORTED - UNSAFE_PAYLOAD_REJECTED - SHARE_PASSWORD_REQUIRED - SHARE_NOT_AVAILABLE - CLIENT_VERSION_REVOKED - CLIENT_VERSION_TOO_OLD - SUPPORT_GRANT_REQUIRED responses: BadRequest: description: >- `BAD_REQUEST`. Also returned with HTTP 413 when a body exceeds the endpoint's byte limit. content: application/json: schema: $ref: '#/components/schemas/ApiError' Forbidden: description: '`FORBIDDEN` — authenticated, but not permitted.' content: application/json: schema: $ref: '#/components/schemas/ApiError' NotFound: description: >- `NOT_FOUND` — the resource does not exist, or exists and you may not know that. content: application/json: schema: $ref: '#/components/schemas/ApiError' ValidationFailed: description: >- `VALIDATION_FAILED` — the shape was right but a value was not acceptable. content: application/json: schema: $ref: '#/components/schemas/ApiError' securitySchemes: sessionCookie: type: apiKey in: cookie name: myrqen_session description: >- Browser session cookie: `httpOnly`, `sameSite=lax`, `Secure` when `APP_BASE_URL` is https, 30-day lifetime. Deliberately separate from CLI device credentials. ````