Shared spaces API
Base URL: https://YOUR-SERVER/api. Send your API key in x-api-key where authentication is required. A key also needs the listed permission; your account's access rules still apply.
API guide · All endpoints · OpenAPI JSON
GET /shared-spaces/invitations— List shared space invitationsGET /shared-spaces/recipient-groups— List recipient groupsPOST /shared-spaces/recipient-groups— Create a recipient groupDELETE /shared-spaces/recipient-groups/{id}— Delete a recipient groupPUT /shared-spaces/recipient-groups/{id}— Update a recipient groupPOST /shared-spaces/{id}/accept— Accept a shared space invitationGET /shared-spaces/{id}/activity— What happened in a shared spaceGET /shared-spaces/{id}/albums— List albums linked into a shared spaceDELETE /shared-spaces/{id}/albums/{albumId}— Unlink an album from a shared spacePUT /shared-spaces/{id}/albums/{albumId}— Link an album into a shared spaceGET /shared-spaces/{id}/comments— List comments in a shared spacePOST /shared-spaces/{id}/comments— Comment in a shared spaceDELETE /shared-spaces/{id}/comments/{commentId}— Remove a shared space commentPUT /shared-spaces/{id}/comments/{commentId}— Edit a shared space commentDELETE /shared-spaces/{id}/invitation— Decline a shared space invitationDELETE /shared-spaces/{id}/invitations/{userId}— Withdraw a shared space invitationGET /shared-spaces/{id}/members— List shared space membersGET /shared-spaces/{id}/new— What is new in a shared space since your last visitGET /shared-spaces/{id}/people— People in a shared spacePOST /shared-spaces/{id}/people— Link a person into a shared spaceDELETE /shared-spaces/{id}/people/{linkId}— Unlink a person from a shared spaceGET /shared-spaces/{id}/preview— Preview a shared spacePOST /shared-spaces/{id}/visit— Mark a shared space seen
List shared space invitations
GET /api/shared-spaces/invitations
Shared spaces the authenticated user has been invited to and has not answered. Each entry is the same safe preview as GET /shared-spaces/{id}/preview: no assets, and counts that exclude media marked sensitive and Locked media.
Authentication: API key. Permission: album.read.
Responses
Field definitions: SharedSpacePreviewResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"items": {
"$ref": "#/components/schemas/SharedSpacePreviewResponseDto"
},
"type": "array"
}
}
},
"description": ""
}
}List recipient groups
GET /api/shared-spaces/recipient-groups
The authenticated user's own named groups of people to invite to a shared space together. A group is a shortcut only: it grants nothing, and its name is never shown to anyone but its owner.
Authentication: API key. Permission: album.read.
Responses
Field definitions: RecipientGroupResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"items": {
"$ref": "#/components/schemas/RecipientGroupResponseDto"
},
"type": "array"
}
}
},
"description": ""
}
}Create a recipient group
POST /api/shared-spaces/recipient-groups
Save a named group of people to invite together. Nobody is invited or given access until the group is applied to a shared space and its invitations are sent.
Authentication: API key. Permission: album.share.
Request body
Required.
Field definitions: RecipientGroupCreateDto
{
"application/json": {
"schema": {
"$ref": "#/components/schemas/RecipientGroupCreateDto"
}
}
}Responses
Field definitions: RecipientGroupResponseDto
{
"201": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/RecipientGroupResponseDto"
}
}
},
"description": ""
}
}Delete a recipient group
DELETE /api/shared-spaces/recipient-groups/{id}
Delete one of your recipient groups. Nobody loses access to anything.
Authentication: API key. Permission: album.share.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | string |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
{
"204": {
"description": ""
}
}Update a recipient group
PUT /api/shared-spaces/recipient-groups/{id}
Rename a group or change who is in it. Existing invitations and memberships are never changed; only the owner's own groups can be updated (anyone else's reads as not found).
Authentication: API key. Permission: album.share.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | string |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Request body
Required.
Field definitions: RecipientGroupUpdateDto
{
"application/json": {
"schema": {
"$ref": "#/components/schemas/RecipientGroupUpdateDto"
}
}
}Responses
Field definitions: RecipientGroupResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/RecipientGroupResponseDto"
}
}
},
"description": ""
}
}Accept a shared space invitation
POST /api/shared-spaces/{id}/accept
Join the shared space with the role its owner offered. The role comes from the stored invitation, never from the request. This is the only way to become a member of a space.
Authentication: API key. Permission: albumUser.update.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | string |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
Field definitions: AlbumResponseDto
{
"201": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/AlbumResponseDto"
}
}
},
"description": ""
}
}What happened in a shared space
GET /api/shared-spaces/{id}/activity
The shared space’s activity feed, newest first: items added and removed, albums and people linked and unlinked, members joining, leaving, being removed or changing role, comments and likes — by every member. Only current members may read it. Every event is narrowed to the caller before it is sent: an item the caller cannot see (Locked, marked sensitive, hidden by their own settings, or no longer in the space) is never named, and an event with nothing visible left is not sent at all, so nothing can be inferred from a count. `unreadCount` is the events by other members since the caller last marked the space seen, computed the same way. Page with `before` and `take`.
Authentication: API key. Permission: album.read.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
before | query | No | Only events before this moment, for paging |
id | path | Yes | string |
take | query | No | Page size, 50 by default |
Parameter types, defaults and constraints
[
{
"name": "before",
"required": false,
"in": "query",
"description": "Only events before this moment, for paging",
"schema": {
"format": "date-time",
"type": "string"
}
},
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
},
{
"name": "take",
"required": false,
"in": "query",
"description": "Page size, 50 by default",
"schema": {
"minimum": 1,
"maximum": 200,
"type": "integer"
}
}
]Responses
Field definitions: SharedSpaceActivityResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpaceActivityResponseDto"
}
}
},
"description": ""
}
}List albums linked into a shared space
GET /api/shared-spaces/{id}/albums
The albums members have linked into the shared space, one level: a space links albums, never another space and never a collection. A link is a reference, not a move and not a share — the album keeps its owner, its members, its access rules and its place in its owner’s tree, and this response grants no access to it. The count and the tile picture come only from items that are in both the album and the space, with media marked sensitive and Locked media excluded.
Authentication: API key. Permission: album.read.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | string |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
Field definitions: SharedSpaceAlbumsResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpaceAlbumsResponseDto"
}
}
},
"description": ""
}
}Unlink an album from a shared space
DELETE /api/shared-spaces/{id}/albums/{albumId}
Remove the reference and only the reference. The album, its items, its members and the shared space’s own items are untouched. The member who made the link, and the shared space owner, may remove it.
Authentication: API key. Permission: album.update.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
albumId | path | Yes | The album to link or unlink |
id | path | Yes | Shared space ID |
Parameter types, defaults and constraints
[
{
"name": "albumId",
"required": true,
"in": "path",
"description": "The album to link or unlink",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
},
{
"name": "id",
"required": true,
"in": "path",
"description": "Shared space ID",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
{
"204": {
"description": ""
}
}Link an album into a shared space
PUT /api/shared-spaces/{id}/albums/{albumId}
Point the shared space at an album the caller can already read. Nothing else happens: no item moves or is copied, no album membership changes, and the album stays where its owner put it. Linking the same album twice is the same single link. An owner or editor of the space may link; a viewer may not.
Authentication: API key. Permission: album.update.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
albumId | path | Yes | The album to link or unlink |
id | path | Yes | Shared space ID |
Parameter types, defaults and constraints
[
{
"name": "albumId",
"required": true,
"in": "path",
"description": "The album to link or unlink",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
},
{
"name": "id",
"required": true,
"in": "path",
"description": "Shared space ID",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
Field definitions: SharedSpaceAlbumsResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpaceAlbumsResponseDto"
}
}
},
"description": ""
}
}List comments in a shared space
GET /api/shared-spaces/{id}/comments
The comments on one item in the shared space (`assetId`), or on the space itself when `assetId` is left out. Oldest first. Only current members may read them, and an item the caller cannot see is not in the space as far as they are concerned (404). Mentions stay as `@{userId}` tokens in the text and are resolved in `mentions`. Threads are one level deep: a reply names its top-level comment in `parentId`, and a top-level comment carries its `replyCount`.
Authentication: API key. Permission: activity.read.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
assetId | query | No | Comments on this item. Left out, the comments on the space itself. |
id | path | Yes | string |
Parameter types, defaults and constraints
[
{
"name": "assetId",
"required": false,
"in": "query",
"description": "Comments on this item. Left out, the comments on the space itself.",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
},
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
Field definitions: SharedSpaceCommentsResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpaceCommentsResponseDto"
}
}
},
"description": ""
}
}Comment in a shared space
POST /api/shared-spaces/{id}/comments
Write a comment on one item in the shared space, or on the space itself when `assetId` is left out. Commenting must be enabled on the space, and the item must be one the caller can see. Mention a member with `@{userId}`: mentions are by id, never by name, every mention must name a current member (400 otherwise), and each mentioned member other than the author is notified. Reply with `parentId`: a reply to a reply joins the same thread under its top-level comment, is on the same item, and notifies the top-level comment’s author in the app.
Authentication: API key. Permission: activity.create.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | string |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Request body
Required.
Field definitions: SharedSpaceCommentCreateDto
{
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpaceCommentCreateDto"
}
}
}Responses
Field definitions: SharedSpaceCommentResponseDto
{
"201": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpaceCommentResponseDto"
}
}
},
"description": ""
}
}Remove a shared space comment
DELETE /api/shared-spaces/{id}/comments/{commentId}
Remove a comment. Its author may, and so may a shared space owner or editor — that is how a space is moderated. A viewer removes only their own. The comment’s mentions and its entry in the activity feed go with it, and removing a top-level comment removes its replies.
Authentication: API key. Permission: activity.delete.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
commentId | path | Yes | The comment |
id | path | Yes | Shared space ID |
Parameter types, defaults and constraints
[
{
"name": "commentId",
"required": true,
"in": "path",
"description": "The comment",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
},
{
"name": "id",
"required": true,
"in": "path",
"description": "Shared space ID",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
{
"204": {
"description": ""
}
}Edit a shared space comment
PUT /api/shared-spaces/{id}/comments/{commentId}
Change what a comment says. Only its author may. Mentions are re-read from the new text under the same rules, and members newly mentioned are notified.
Authentication: API key. Permission: activity.update.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
commentId | path | Yes | The comment |
id | path | Yes | Shared space ID |
Parameter types, defaults and constraints
[
{
"name": "commentId",
"required": true,
"in": "path",
"description": "The comment",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
},
{
"name": "id",
"required": true,
"in": "path",
"description": "Shared space ID",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Request body
Required.
Field definitions: SharedSpaceCommentUpdateDto
{
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpaceCommentUpdateDto"
}
}
}Responses
Field definitions: SharedSpaceCommentResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpaceCommentResponseDto"
}
}
},
"description": ""
}
}Decline a shared space invitation
DELETE /api/shared-spaces/{id}/invitation
Decline the invitation. Nothing else changes: the shared space and its photos are untouched, and the owner may invite again later.
Authentication: API key. Permission: albumUser.delete.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | string |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
{
"204": {
"description": ""
}
}Withdraw a shared space invitation
DELETE /api/shared-spaces/{id}/invitations/{userId}
Withdraw a pending invitation. Only the shared space owner can do this, and it only reaches people who have not joined; removing a member is DELETE /albums/{id}/user/{userId}.
Authentication: API key. Permission: albumUser.delete.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | Shared space ID |
userId | path | Yes | The invited user |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"description": "Shared space ID",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
},
{
"name": "userId",
"required": true,
"in": "path",
"description": "The invited user",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
{
"204": {
"description": ""
}
}List shared space members
GET /api/shared-spaces/{id}/members
Everyone in the shared space and everyone invited to it who has not answered. Any member may read the roster; only the owner may change it.
Authentication: API key. Permission: album.read.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | string |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
Field definitions: SharedSpaceMembersResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpaceMembersResponseDto"
}
}
},
"description": ""
}
}What is new in a shared space since your last visit
GET /api/shared-spaces/{id}/new
Items other members added since the caller last marked this shared space seen. The marker is per member. If the caller has never marked it seen, everything in the space counts as new to them. The caller’s own additions are left out, and media marked sensitive and Locked media are excluded.
Authentication: API key. Permission: album.read.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | string |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
Field definitions: SharedSpaceNewResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpaceNewResponseDto"
}
}
},
"description": ""
}
}People in a shared space
GET /api/shared-spaces/{id}/people
Two lists. `linked` is who members have published into the space, carrying the space’s own name for each one and a picture that is already in the space — never the owner’s private name, thumbnail, birth date or person ID. `candidates` is the caller’s own people seen on the space’s items, so they can publish one; no other member’s people are ever listed. Counts exclude media marked sensitive and Locked media.
Authentication: API key. Permission: album.read.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | string |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
Field definitions: SharedSpacePeopleResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpacePeopleResponseDto"
}
}
},
"description": ""
}
}Link a person into a shared space
POST /api/shared-spaces/{id}/people
Publish one of the caller’s own people into the shared space under a name the space uses. The name is independent: it never renames the caller’s own person, and renaming that person does not rename it here. The caller’s person record is not disclosed to anybody. Linking the same person again rewrites the link rather than adding a second one.
Authentication: API key. Permission: person.update.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | string |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Request body
Required.
Field definitions: SharedSpacePersonLinkDto
{
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpacePersonLinkDto"
}
}
}Responses
Field definitions: SharedSpacePeopleResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpacePeopleResponseDto"
}
}
},
"description": ""
}
}Unlink a person from a shared space
DELETE /api/shared-spaces/{id}/people/{linkId}
Remove the link and only the link. The person, their name, their faces and every item that shows them are untouched, and so are the shared space’s items. The member who made the link, and the shared space owner, may remove it.
Authentication: API key. Permission: person.update.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | Shared space ID |
linkId | path | Yes | The person link to remove |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"description": "Shared space ID",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
},
{
"name": "linkId",
"required": true,
"in": "path",
"description": "The person link to remove",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
{
"204": {
"description": ""
}
}Preview a shared space
GET /api/shared-spaces/{id}/preview
What the shared space exposes, for someone holding an invitation to it or already in it. The preview carries no asset: no ids, no thumbnails, no file names, no people and no places. Counts and dates exclude media marked sensitive and Locked media. Anyone without an invitation or membership gets 404.
Authentication: API key. Permission: album.read.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | string |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
Field definitions: SharedSpacePreviewResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpacePreviewResponseDto"
}
}
},
"description": ""
}
}Mark a shared space seen
POST /api/shared-spaces/{id}/visit
Move the caller’s own last-seen marker to now and return what is new after doing so. This is deliberately explicit rather than something opening the page does, so glancing at a space on a phone does not silently clear the list of what has not been looked at.
Authentication: API key. Permission: album.read.
Parameters
| Name | Where | Required | Description |
|---|---|---|---|
id | path | Yes | string |
Parameter types, defaults and constraints
[
{
"name": "id",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
"type": "string"
}
}
]Responses
Field definitions: SharedSpaceNewResponseDto
{
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SharedSpaceNewResponseDto"
}
}
},
"description": ""
}
}© 2026 Frameleaf Inc. All rights reserved.
Frameleaf and the Frameleaf logo are Trademarks of Frameleaf Inc.