{
"grant": {
"token": "g1.example",
"expiresAt": "2026-10-21T12:15:00.000Z"
}
}{
"error": {
"code": "INVALID_REQUEST",
"message": "Send the password as a string."
}
}{
"error": {
"code": "PASSWORD_INCORRECT",
"message": "That password is not right."
}
}{
"error": {
"code": "ARTIFACT_NOT_FOUND",
"message": "Artifact was not found."
}
}{
"error": {
"code": "RATE_LIMITED",
"message": "Too many password attempts. Try again later."
}
}{
"error": {
"code": "UNLOCK_UNAVAILABLE",
"message": "Password verification is busy. Try again."
}
}Unlock a password-protected share
No session. JSON { password }. A matching password returns { grant: { token, expiresAt } } valid for 15 minutes. A link with no password returns { grant: null }. A wrong password is 401 PASSWORD_INCORRECT. An inactive link is 404 ARTIFACT_NOT_FOUND. A missing or non-JSON body is 400 INVALID_REQUEST before any password throttle is charged. Client failures allow 10 per 10 minutes. Share failures allow 30 per 10 minutes, charged only after a wrong password. An exhausted share is 429 RATE_LIMITED with Retry-After and no hash verification. A saturated Argon2 gate, or a share whose remaining slots are all in flight, is 503 UNLOCK_UNAVAILABLE with Retry-After. This route ignores a leftover session cookie and does not apply the cookie origin guard.
{
"grant": {
"token": "g1.example",
"expiresAt": "2026-10-21T12:15:00.000Z"
}
}{
"error": {
"code": "INVALID_REQUEST",
"message": "Send the password as a string."
}
}{
"error": {
"code": "PASSWORD_INCORRECT",
"message": "That password is not right."
}
}{
"error": {
"code": "ARTIFACT_NOT_FOUND",
"message": "Artifact was not found."
}
}{
"error": {
"code": "RATE_LIMITED",
"message": "Too many password attempts. Try again later."
}
}{
"error": {
"code": "UNLOCK_UNAVAILABLE",
"message": "Password verification is busy. Try again."
}
}Path Parameters
Artifact UUID.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$Public share token from the owner share URL. The stored column is a hash, not this value.
1Body
The link password.
1 - 1024Response
A grant for a protected link, or null when the link has no password.
Show child attributes
Show child attributes