Get Public Share Link
Returns the shared document's title and snapshot, unless the link is password-protected — in which case only `passwordRequired: true` is returned and the caller must call `POST /shares/public/{username}/{slug}/verify` with the password. No user session is required, but the request is still gated: it must carry an API key, or originate from a whitelisted first-party origin. A bare request from an unrecognised origin is rejected with `401`.
Authorization
ApiKeyAuth Your personal API key — vw_ followed by 64 hex characters. The same key is also accepted
as Authorization: Bearer vw_....
In: header
Path Parameters
Response Body
application/json
application/json
application/json
curl -X GET "https://example.com/api/v1/shares/public/string/string"{ "success": true, "message": "string", "data": { "passwordRequired": true, "resumeTitle": "string", "documentTitle": "string", "expiresAt": "2019-08-24T14:15:22Z", "snapshot": {} }}Revoke Share LinkDELETE
Deletes the share link, immediately breaking its public URL. `data` is `null` on success. Requires the `resume:write` scope when called with an API key.
Verify Public Share Link PasswordPOST
Verifies a password-protected share link's password using a timing-safe comparison against the stored scrypt hash, and returns the full snapshot on success. No user session is required, but the request must carry an API key or originate from a whitelisted first-party origin, same as the read endpoint. **Rate limited to 3 attempts per 5 minutes per IP** — considerably tighter than the rest of the API, to make these links impractical to brute-force.