Share links

Every “premium” control ships on every tier — passwords (argon2id), custom expiry, download limits, notes, notifications. Tiers differ by capacity only. Free-tier links default to 48 hours and cap at 7 days; organization link policies (require password, cap lifetime, disable public links) are enforced here, at creation, not hidden in a UI.

Create

curl -X POST https://api.sendflo.app/v1/links \
  -H "authorization: Bearer $TOKEN" -H "content-type: application/json" \
  -d '{"file_id":"<file id>","password":"hunter2","max_downloads":10,"note":"Q3 cut"}'

List your workspace’s links and files

Runnable with an agent API key (or any bearer token). Links come newest first, 25 to a page (up to 100 with?limit=); pass next_cursor back as ?cursor= for the next page. Revoked links stay listed with revoked_at set.

GET /v1/links

GET /v1/files

Anonymous download

The public page resolves by slug; the download endpoint answers with a presigned URL (or a CDN URL for durable files). Quarantined and unscanned content fails closed for the public.

curl -X POST https://api.sendflo.app/v1/link-pages/<slug>/download \
  -H "content-type: application/json" -d '{"password":"hunter2"}'

Revoke one file

Ends one link for good and frees its storage at once. On pooled storage the answer is a 200 with retained_until: the provider’s minimum keeps a hidden copy until then, at SendFlo’s cost.

curl -X DELETE https://api.sendflo.app/v1/links/<id> -H "authorization: Bearer $TOKEN"

Pause, resume or revoke a whole send

A multi-file send has one link per file. Any of them names the whole transfer. Pause is reversible: every file answers 403 link_paused (“Paused by the sender.”) and keeps its storage. Resume never lifts a pause set by a safety review. Revoke can’t be undone; it ends every file and frees the storage, except bytes another live link shares, a File Restore window keeps, or a review needs.

curl https://api.sendflo.app/v1/links/<id>/transfer -H "authorization: Bearer $TOKEN"
curl -X PUT https://api.sendflo.app/v1/links/<id>/transfer/pause -H "authorization: Bearer $TOKEN"
curl -X DELETE https://api.sendflo.app/v1/links/<id>/transfer/pause -H "authorization: Bearer $TOKEN"
curl -X POST https://api.sendflo.app/v1/links/<id>/transfer/revoke -H "authorization: Bearer $TOKEN"

Who opened what, when and from where

One call covers every file of a send. The first page carries people: each person (or “Visitor N” for someone who never gave an email) with when they first opened it, the files they downloaded, the countries, a coarse device class such as “Chrome · Windows” and the proof of delivery — receipts when the SendFlo apps or CLI proved every byte, handed_off for a browser download (browsers send no receipt). events is the timeline, newest first; pass next_cursor back as cursor for older events. IP addresses are never returned.

curl "https://api.sendflo.app/v1/links/<id>/transfer/activity" -H "authorization: Bearer $TOKEN"
curl "https://api.sendflo.app/v1/links/<id>/transfer/activity?cursor=<next_cursor>" -H "authorization: Bearer $TOKEN"

Audit report

Everything that happened to a send, as one file for an auditor or a client: the send, each file, each person, your own actions (revokes, pauses, people removed or restored) and every event with its proof of delivery. CSV is one table with a section column, opens cleanly in Excel and never runs a formula; JSON has the same content.

curl -o audit.csv "https://api.sendflo.app/v1/links/<id>/transfer/audit?format=csv" -H "authorization: Bearer $TOKEN"
curl -o audit.json "https://api.sendflo.app/v1/links/<id>/transfer/audit?format=json" -H "authorization: Bearer $TOKEN"

Remove one person from all or some files

On a Tracked or Restricted send, people lists everyone who can open it and which files each can open. Setting a person’s files removes every file not named, even after a download: those files answer 403 access_revoked (“This file is no longer available because the sender has revoked access to this link.”) while the others still open. Naming a file again only restores an address you removed; it never adds anyone. A Public send answers 409 public_link.

curl https://api.sendflo.app/v1/links/<id>/transfer/people -H "authorization: Bearer $TOKEN"
curl -X POST https://api.sendflo.app/v1/links/<id>/transfer/people/access -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" -d '{"email":"alex@partner.example","files":["<link id>"]}'
curl -X POST https://api.sendflo.app/v1/links/<id>/transfer/people/access -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" -d '{"email":"alex@partner.example","files":[]}'   # remove from the whole send