Share Links

Share links let you grant access to a document without requiring the recipient to have a Notebind account. Each link has a permission level and optional expiration.

Share link object

{
  "id": "link-uuid",
  "document_id": "doc-uuid",
  "created_by": "user-uuid",
  "token": "a21e739e4fcf3cc2844e4b23a3b14b14",
  "permission": "comment",
  "expires_at": null,
  "created_at": "2026-03-13T12:00:00.000Z"
}

Field	Type	Description
id	UUID	Share link identifier
document_id	UUID	The shared document
created_by	UUID	Who created the link
token	string	32-character hex token
permission	string	"view", "comment", or "edit"
expires_at	ISO 8601 or null	When the link expires (null = never)
created_at	ISO 8601	When the link was created

Permission levels

Permission	View document	List comments	Create comments	Edit content	Create suggestions
view	Yes	Yes	No	No	No
comment	Yes	Yes	Yes	No	No
edit	Yes	Yes	Yes	Yes	Yes

Note

Share link users cannot modify the document title, delete documents, or manage share links — regardless of permission level.

Shareable URL format

https://notebind.com/share/{token}

This URL loads the document in a public viewer with controls matching the permission level.

---

List share links

GET /api/documents/:id/share

Returns all share links for a document. Only the document owner can list share links.

Request

curl https://notebind.com/api/documents/DOC_ID/share \
  -H "Authorization: Bearer nb_sk_YOUR_KEY"

Response 200 OK

{
  "data": [
    {
      "id": "link-uuid",
      "token": "a21e739e4fcf3cc2844e4b23a3b14b14",
      "permission": "comment",
      "expires_at": null,
      "created_at": "2026-03-13T12:00:00.000Z"
    }
  ],
  "error": null
}

---

Create a share link

POST /api/documents/:id/share

Request body

Field	Type	Required	Default	Description
permission	string	No	"view"	"view", "comment", or "edit"
expires_at	ISO 8601	No	null	When the link should expire

Request

curl -X POST https://notebind.com/api/documents/DOC_ID/share \
  -H "Authorization: Bearer nb_sk_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"permission": "comment"}'

Response 201 Created

{
  "data": {
    "id": "link-uuid",
    "document_id": "doc-uuid",
    "created_by": "user-uuid",
    "token": "a21e739e4fcf3cc2844e4b23a3b14b14",
    "permission": "comment",
    "expires_at": null,
    "created_at": "2026-03-13T12:00:00.000Z"
  },
  "error": null
}

Creating a link with expiration

curl -X POST https://notebind.com/api/documents/DOC_ID/share \
  -H "Authorization: Bearer nb_sk_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"permission": "edit", "expires_at": "2026-04-01T00:00:00.000Z"}'

Tip

Invalid permission values silently default to "view". Valid values are: view, comment, edit.

---

Revoke a share link

DELETE /api/documents/:id/share?link_id=LINK_ID

Revokes a share link. Anyone with the token will no longer be able to access the document.

Query parameters

Parameter	Type	Required	Description
link_id	UUID	Yes	The share link ID to revoke

Request

curl -X DELETE "https://notebind.com/api/documents/DOC_ID/share?link_id=LINK_ID" \
  -H "Authorization: Bearer nb_sk_YOUR_KEY"

Response 200 OK

{
  "data": { "deleted": true },
  "error": null
}

---

Using share tokens in API calls

Share tokens can be passed as query parameters to access document endpoints without authentication:

# Read a document
curl "https://notebind.com/api/documents/DOC_ID?share_token=TOKEN"

# List comments
curl "https://notebind.com/api/documents/DOC_ID/comments?share_token=TOKEN"

# Create a comment (requires comment or edit permission)
curl -X POST "https://notebind.com/api/documents/DOC_ID/comments?share_token=COMMENT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"body": "Looks great!"}'

# Update content (requires edit permission)
curl -X PATCH "https://notebind.com/api/documents/DOC_ID?share_token=EDIT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"content": "Updated content"}'

Expired and revoked tokens

Expired or revoked tokens return:

{
  "data": null,
  "error": { "message": "Unauthorized", "code": "UNAUTHORIZED" }
}

---

Error responses

Status	Code	Description
400	VALIDATION_ERROR	Missing link_id on delete
401	UNAUTHORIZED	Missing or invalid credentials
404	NOT_FOUND	Document not found or not owned by you