## Public link to a folder

`POST /v1/folders/:id/public-link`

Creates a public link to a folder or returns the existing one: anyone who has the link can open the entire folder contents, including files added later. The link cannot be revoked through the API.

## Parameters

| Parameter | Type | Required | Description |
|----------|-----|:-----:|----------|
| `id` (path) | number | yes | Folder ID. List: `GET /v1/folders?parentId=X`. The root folder of a storage cannot be published |

No request body is sent.

## Examples

### curl — personal key

```bash
curl -X POST "https://vibecode.bitrix24.com/v1/folders/10741/public-link" \
  -H "X-Api-Key: YOUR_API_KEY"
```

### curl — OAuth application

```bash
curl -X POST "https://vibecode.bitrix24.com/v1/folders/10741/public-link" \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN"
```

### JavaScript — personal key

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/folders/10741/public-link', {
  method: 'POST',
  headers: {
    'X-Api-Key': 'YOUR_API_KEY',
  },
})
const body = await res.json()
if (!body.success) throw new Error(body.error.code)
const link = body.data.url
console.log('Link received, folder in trash:', body.meta.inTrash)
```

### JavaScript — OAuth application

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/folders/10741/public-link', {
  method: 'POST',
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
  },
})
const body = await res.json()
if (!body.success) throw new Error(body.error.code)
const link = body.data.url
console.log('Link received, folder in trash:', body.meta.inTrash)
```

## Response fields

| Field | Type | Description |
|------|-----|----------|
| `success` | boolean | `true` on success |
| `data.url` | string | Public link to the folder. Opens the folder and all its contents without authorization |
| `data.revocableViaApi` | boolean | Always `false`: the link cannot be revoked through the API |
| `meta.inTrash` | boolean | `true` — the folder is in the trash. The link is issued but opens the folder only after [restoration](/docs/entities/folders/restore) |

## Response example

```json
{
  "success": true,
  "data": {
    "url": "https://bitrix24public.com/<portal>.bitrix24.com/folder/EXAMPLE_TOKEN",
    "revocableViaApi": false
  },
  "meta": {
    "inTrash": false
  }
}
```

## Error response example

400 — the folder is a storage root:

```json
{
  "success": false,
  "error": {
    "code": "INVALID_PARAMS",
    "message": "A storage root cannot be published."
  }
}
```

## Errors

| HTTP | Code | Description |
|------|-----|----------|
| 400 | `INVALID_ID` | `id` is not a positive integer |
| 400 | `INVALID_PARAMS` | The folder is a storage root. The request is rejected before it reaches Bitrix24, so that the entire personal or shared Drive is not exposed |
| 401 | `TOKEN_MISSING` | The key's portal has no authorization tokens |
| 403 | `SCOPE_DENIED` | The key lacks the `disk` scope |
| 403 | `WRITE_BLOCKED_READONLY_KEY` | The key is in read-only mode, and creating a link changes portal data |
| 403 | `BITRIX_ACCESS_DENIED` | The key owner has no permission to change the folder, or public links are disabled on the portal. The response does not distinguish these reasons |
| 404 | `ENTITY_NOT_FOUND` | There is no folder with this `id` |
| 422 | `DISK_PUBLIC_LINK_REFUSED` | Bitrix24 did not return a link |
| 422 | `BITRIX_ERROR` | Bitrix24 refused to create the link; the reason is in `message` |
| 429 | `RATE_LIMITED` | Request limit exceeded — wait 1-2 seconds and retry |
| 502 | `DISK_OUTCOME_UNKNOWN` | The connection to Bitrix24 dropped after the link was requested. The outcome is unknown, and no retry was made. A repeat call returns the same link if it was created |
| 502 | `BITRIX_UNAVAILABLE` | Bitrix24 was unavailable while the folder was being read; the link was not requested |

Full list of common API errors — [Errors](/docs/errors).

## Known specifics

**The link is an access secret.** The response comes with the `Cache-Control: private, no-store` header. Do not write `data.url` to logs, audit records or telemetry.

**Existing link.** If the folder already has a public link, the call returns it instead of creating a new one. It may be another employee's link, including one with a password or an expiration date: the response does not say whether it is protected.

**Trash and deletion.** While the folder is in the trash, the link does not open it; after restoration it opens the folder again. Via the API, the only way to disable the link is to [permanently delete the folder](/docs/entities/folders/purge).

**Batch calls.** The method is not part of [`POST /v1/batch`](/docs/batch) — call it as a separate request.

## See also

- [Get a folder](/docs/entities/folders/get)
- [Restore folder](/docs/entities/folders/restore)
- [Permanently delete folder](/docs/entities/folders/purge)
- [Share a folder with a user](/docs/entities/folders/shares)
- [Public link to a file](/docs/entities/files/public-link)
- [Folders](/docs/entities/folders)