API pipeline: Claim an access link

Goal: open an access link someone sent you and get the shared cards into your account, for one of your projects or for one of your agendas; see what is shared with you.

Steps

As a person

1. Open it.

GET /v0/linked/<token>?project=<your project>
→ {"title": "…", "read": true, "write": true, "execute": false,
   "cards": [{"card_type": "campaign", "nonce": "<card>", "title": "…", "visibility": "Unlisted"}]}

An Ecosystem link needs you signed in and stores the access for one of your projects: the one you pass, or your only project. An Everyone link just shows the cards, nothing is stored.

2. One shared card: GET /v0/linked/<token>/<card_type>/<card> (same project rule).

As an agenda

POST /v0/my/agendas/<agenda>/claim
{"token": "<token>"}
→ {"agenda": "<agenda>", "cards": [...]}

No project here.

What is shared with you

GET /v0/graph/my/granted
→ {"granted": [{"tile": {…}, "rights": {"read": true, "write": true, "execute": false},
                "via": [{"nonce": "<link>", "title": "…", "owner": "…", "expires_at": "…"}]}], "total": 1}

Use the cards with the usual routes, within the rights you got.

Rules

• Signed out on an Ecosystem link → 401.
• Project (person, Ecosystem): several projects and none passed → 400 pick which of your projects claims this link: pass project=<nonce>; not yours → 400 project <n> not found or not yours: …; none → 400 claiming this link needs a project of yours: ….
• A link opens only for the claimers it was made for (people, agendas or both).
• An access that ended (time over or revoked by the owner) can be renewed only by the link owner.
• A link you cannot use opens nothing.
• Opening again is not a new claim: your access keeps its first end time.

API surface

Index: API pipelines — index