Sharing API

Share link endpoints for TMA Cloud.

Note: There is no share-specific limiter. Routes under /s/ use the general API limiter: 10,000 requests per 15 minutes. Share links are unauthenticated, so the key is the IP address. Because these are the only routes reachable without a session, put a tighter limit in front of /s/ at your reverse proxy if you publish links widely. See Rate Limits.

Share Links (Public)Copy Anchor Link

GET /s/:tokenCopy Anchor Link

View a shared file or folder. A folder returns a listing page. A single-file share returns a landing page with a download button.

Folder rows are returned in keyset pages of 100 and the page loads the next set automatically near the end of the list. A client sending Accept: application/json receives { items, nextCursor }; pass that opaque value back as ?cursor=. limit may be 1–200.

Validation:

• token: Required. Must be a non-empty string.

Responses:

• 200 - HTML page with shared files
• 404 - Link does not exist, has been removed, or the shared item is in Trash
• 410 - Link has expired

GET /s/:token/folder/:idCopy Anchor Link

Browse a subfolder inside a shared folder. Returns the listing page for that folder. The folder must be part of the share.

The same cursor, limit, and JSON response behavior used by the root folder applies here.

Validation:

• token: Required. Must be a non-empty string.
• id: Required. Must be a non-empty string.

Responses:

• 200 - HTML page with the subfolder's contents
• 404 - Link not found, the folder is not part of this share, or the folder is in Trash
• 410 - Link has expired

GET /s/:token/file/:idCopy Anchor Link

Download an item from a share link. A file id downloads the file. A folder id downloads that folder's contents as a ZIP.

Validation:

• token: Required. Must be a non-empty string.
• id: Required. Must be a non-empty string.

Responses:

• 200 - File or ZIP download
• 404 - Link or file not found, or the item is in Trash
• 410 - Link has expired

GET /s/:token/zipCopy Anchor Link

Download a folder as ZIP from a share link. Entry names follow the same Windows-safe rule as an authenticated folder download.

Validation:

• token: Required. Must be a non-empty string.

Responses:

• 200 - ZIP archive download
• 404 - Link not found, not a folder, or the folder is in Trash
• 410 - Link has expired

Related TopicsCopy Anchor Link

• Files - File management endpoints
• Sharing Model - How sharing works