Public Shares
Anonymous access to shared buckets/files/folders. Distinct from "Bucket Shares" (which manages share links as the owner); these endpoints are consumed by whoever holds the share link. The safebucket_share_token cookie (issued by POST /shares/{id}/auth) is only required when the share is password-protected; shares without a password are accessible without any token (401 SHARE_TOKEN_REQUIRED / SHARE_TOKEN_INVALID otherwise). Every endpoint under /shares/{shareId} can additionally return 404 SHARE_NOT_FOUND (unknown or revoked share), 410 SHARE_EXPIRED, and 403 SHARE_MAX_VIEWS_REACHED from the shared access-validation middleware.
Authenticate against a password-protected share
Public endpoint (no user auth). On success issues a `safebucket_share_token` cookie scoped to this share, required by every other endpoint under `/shares/{shareId}`.
List the files/folders available in a share
Requires a valid `safebucket_share_token` cookie if the share is password-protected. Increments the share's view counter.
Download a single-file share via 302 redirect
Convenience endpoint for shares of type `files` containing exactly one live file: responds `302 Found` pointing at the presigned storage URL. Only available when `app.allow_redirect_download` is enabled. Requires a valid `safebucket_share_token` cookie if the share is password-protected.
Get a presigned download URL for a shared file
Requires a valid `safebucket_share_token` cookie if the share is password-protected.
Download a shared file via 302 redirect
Redirect variant of the presigned-URL endpoint: responds `302 Found` pointing at the presigned storage URL. Only available when `app.allow_redirect_download` is enabled. Note: unlike the other share endpoints, this path is currently not on the authentication bypass list, so it requires a regular authenticated session in addition to the share cookie.
Confirm a shared upload completed
Requires a valid `safebucket_share_token` cookie if the share is password-protected. Required for storage providers without bucket-notification support, analogous to the authenticated file-confirm flow.
Start a file upload into a share
Requires a valid `safebucket_share_token` cookie if the share is password-protected. Only allowed when the share has `allow_upload: true`. Returns a presigned POST policy, mirroring the authenticated upload flow.