Read a share link's server-side prefill (token is the bearer credential)
get shared flow: reference page for this CustomDomain™ API operation in the sharing group. Covers parameters, request body, responses and error codes.
Public by design: the opaque, unguessable token in the path IS the credential (mirroring the OAuth callback's state-as-credential pattern), so no bearer is required. Returns the stored prefill so a teammate's widget can resume the flow. A share token EXPIRES 30 days after it is minted; unknown OR expired tokens are indistinguishable and both return 404.
The widget_token it answers reaches only the shared domains (intersected with the sharer's binding when the sharer was bound) and owns exactly what the sharer owned: the sharer's end user and the domains the sharer's own binding made its own, never the shared domains it is bound to (createSharedFlow). So it sets the connection the link was made for up as the end user would (the secure sign in, managed DNS, a nameserver move, the monitoring reads), and acts on a connection that names no end user only when the sharer could have (a link from a sharer that names no end user and is bound to no domain may start the secure sign in on the connection it owns, the one a call is about). A link made before the sharer was recorded (before this release), and one whose shared domains are all outside the sharer's binding, mints no widget_token; the first is answered 404 like an expired link, whose answer the console words as "invalid or expired, ask for a fresh link". A reconnect link is the end user's own and keeps working, except that one whose key was replaced by another, or whose connection is gone, now answers 404 too (it used to open the plain flow). A share link is a credential for that one setup, not the end user, so it never removes the domain (403 forbidden, on every connection), never sets the end user's contact address (on any connection), is never offered the end user's kept keys (saved access) and is not the maker of a key as the end user: a key made at a sign in it starts is not the end user's own for saved access, and is never swapped into a key row the end user already keeps, and its sign in is never in reconnect mode (403 forbidden: it cannot renew the end user's key). A reconnect link's token stays the end user.
Path Parameters
Response Body
application/json
application/json
curl -X GET "https://example.com/share/string"{ "token": "string", "application_id": "string", "job_id": "string", "prefill": {}}{ "code": "string", "title": "string", "details": "string"}