Who a document is shared with

GET

/api/v1/documents/{id}/permissions

App integration: Use this for an access panel. Only owners receive pending invitations. An absent invitations field does not prove that none exist. Keep permissions separate from the API token's own scope list.

Request

Authorization

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

OAuth 2.0

Authorization Code

Add the parameter

Authorization

to Headers，whose value is to concatenate the Token after the Bearer.

Example:

Authorization: Bearer ********************

Authorize URL: https://handwrites.io/oauth/authorize

Token URL: https://handwrites.io/api/oauth/token

Refresh URL: https://handwrites.io/api/oauth/token

Scopes:

permissions:read-See who a document is shared with

Path Params

Responses

🟢200

application/json

The owner, permissions and (owner only) pending invitations.

Headers

Bodyapplication/json

🟠401Unauthorized

🟠403Forbidden

🟠404NotFound

🟠429TooManyRequests

🔴500ServerError

Request Example

Shell

JavaScript

Java

Swift

curl --location '/api/v1/documents//permissions' \
--header 'Authorization: Bearer <token>'

Response Example

200 - Example 1

{
    "owner": "user:3f2b…",
    "permissions": [
        {
            "principal": "user:3f2b…",
            "role": "viewer",
            "email": "string",
            "grantedBy": "user:3f2b…",
            "createdAt": "2019-08-24T14:15:22.123Z",
            "updatedAt": "2019-08-24T14:15:22.123Z"
        }
    ],
    "invitations": [
        {
            "id": "string",
            "email": "string",
            "role": "viewer",
            "status": "pending",
            "invitedBy": "user:3f2b…",
            "createdAt": "2019-08-24T14:15:22.123Z",
            "expiresAt": "2019-08-24T14:15:22.123Z"
        }
    ]
}

Modified at 2026-10-26 12:58:15

Sharing API — README

Share by principal, or invite by email (owner)