Share a package with a person or a space
Offer the package to a space — its AUDIENCE, never its activation, which stays the recipient's own act (POST /api/spaces/{spaceId}/packages). Requires the package type's share permission in the package's home space; share is carried by the admin and builder presets and by no API key. A user target additionally requires members:read and is resolved server-side to that member's personal space, created if they have none — the sharer never learns its id. A space target must be a space the caller can reach, so another member's personal space is not targetable by id (404). Sharing a package with the space it already lives in is 409 share_target_is_home. EVERY target requires the package to have a published version (409 package_has_no_version): outside its home a package runs its latest published version, so an offer with nothing published is an offer of nothing. Idempotent: sharing the same pair twice answers 200 with the same entry.
/api/packages/{scope}/{name}/sharesCookie session from Better Auth. Requires X-Org-Id header for org-scoped routes.
In: cookie
Path Parameters
Package scope (e.g. @myorg)
^@[a-z0-9][a-z0-9-]*$Package name
Header Parameters
Organization ID. Required for cookie auth. Not needed for API key auth (org resolved from key).
uuidSpace ID. Required for space-scoped routes (agents, runs, schedules, and space-scoped module routes). Not needed for API key auth (space resolved from key).
Request Body
application/json
curl -X POST "https://your-instance/api/packages/string/string/shares" \ -H "Content-Type: application/json" \ -d '{ "target": { "kind": "user", "userId": "string" } }'{
"object": "package_share",
"target": {
"kind": "user",
"userId": "string",
"spaceId": "string",
"name": "string"
},
"shared_by": {
"user_id": "string",
"name": "string"
},
"createdAt": "2019-08-24T14:15:22Z"
}{
"type": "https://docs.appstrate.dev/errors/validation-failed",
"title": "Validation Failed",
"status": 400,
"detail": "name: Invalid input: expected string, received undefined (+2 more)",
"code": "validation_failed",
"request_id": "req_abc123",
"errors": [
{
"field": "name",
"code": "required",
"message": "Invalid input: expected string, received undefined"
},
{
"field": "email",
"code": "invalid_format",
"message": "Invalid email address"
},
{
"field": "age",
"code": "invalid_type",
"message": "Invalid input: expected number, received string"
}
]
}{
"type": "https://docs.appstrate.dev/errors/unauthorized",
"title": "Unauthorized",
"status": 401,
"detail": "Invalid or missing session",
"code": "unauthorized",
"request_id": "req_abc123"
}{
"type": "https://docs.appstrate.dev/errors/forbidden",
"title": "Forbidden",
"status": 403,
"detail": "Insufficient permissions",
"code": "forbidden",
"request_id": "req_abc123"
}{
"type": "https://docs.appstrate.dev/errors/not-found",
"title": "Not Found",
"status": 404,
"detail": "Resource not found",
"code": "not_found",
"request_id": "req_abc123"
}{
"type": "http://example.com",
"title": "string",
"status": 0,
"detail": "string",
"instance": "string",
"code": "string",
"request_id": "string",
"param": "string",
"retry_after": 0,
"errors": [
{
"field": "string",
"code": "string",
"message": "string",
"title": "string",
"candidate_connections": [
{
"id": "string",
"label": "string",
"account_id": "string",
"owned_by_actor": true,
"needs_reconnection": true
}
],
"connection_id": "string",
"missing_scopes": [
"string"
],
"owned_by_actor": true,
"required_scopes": [
"string"
],
"auth_key": "string",
"required_auth_key": "string",
"available_auth_keys": [
"string"
],
"connect_url": "http://example.com",
"expiresAt": "2019-08-24T14:15:22Z",
"packageId": "string"
}
]
}