{
"artifact": {
"id": "11111111-1111-4111-8111-111111111111",
"filename": "11111111-1111-4111-8111-111111111111.html",
"name": "hello",
"mimeType": "text/html",
"sizeBytes": 527,
"uploadedAt": "2026-10-21T12:00:00.000Z",
"contentUrl": "http://localhost:3001/api/v1/public/artifacts/11111111-1111-4111-8111-111111111111/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/content",
"passwordProtected": false
}
}{
"error": {
"code": "PASSWORD_REQUIRED",
"message": "This link needs a password."
}
}{
"error": {
"code": "ARTIFACT_NOT_FOUND",
"message": "Artifact was not found."
}
}{
"error": {
"code": "RATE_LIMITED",
"message": "Too many requests. Try again later."
}
}Read a public share
No session. The response omits creator, organization, access type, and the share URL. An inactive, unknown, or revoked token is 404 ARTIFACT_NOT_FOUND and does not say whether the artifact exists. A password-protected share without a valid X-Factrove-Share-Grant is 401 PASSWORD_REQUIRED. The view allowance is charged per visitor address before the link lookup and password check, so a 401 or 404 still consumes it. IPv6 addresses share a /64. A charge grants two companion content loads for 30 seconds. View units are limited to 60 per 60 seconds per client address, in memory on each API process. A content request without a remaining companion charges another view unit before its own lookup. That 429 does not include Retry-After. Responses send Referrer-Policy: no-referrer and X-Robots-Tag: noindex.
{
"artifact": {
"id": "11111111-1111-4111-8111-111111111111",
"filename": "11111111-1111-4111-8111-111111111111.html",
"name": "hello",
"mimeType": "text/html",
"sizeBytes": 527,
"uploadedAt": "2026-10-21T12:00:00.000Z",
"contentUrl": "http://localhost:3001/api/v1/public/artifacts/11111111-1111-4111-8111-111111111111/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/content",
"passwordProtected": false
}
}{
"error": {
"code": "PASSWORD_REQUIRED",
"message": "This link needs a password."
}
}{
"error": {
"code": "ARTIFACT_NOT_FOUND",
"message": "Artifact was not found."
}
}{
"error": {
"code": "RATE_LIMITED",
"message": "Too many requests. Try again later."
}
}Headers
Unlock grant from POST /unlock. Never a cookie and never part of a URL. The HTTP header is X-Factrove-Share-Grant.
Path Parameters
Artifact UUID.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$Public share token from the owner share URL. The stored column is a hash, not this value.
1Response
Public artifact metadata. contentUrl may include a short-lived ticket query after a grant.
Show child attributes
Show child attributes