Create links

Grants access: it mints a public share link over one data room (dataroomId) or one document (documentId) — one of the two is required — and answers with the link, whose id is the token a visitor opens it with.

POST /v1/dataroom/links

Dataroom → · All API references → · Get started →

Address	`https://api.hanzo.ai/v1/dataroom/links`
Method	`POST`
Operation	`post_dataroom_links`
Auth	`Authorization: Bearer $HANZO_API_KEY`

This is how a party is let in. The controls are declared HERE and enforced on the viewer surface: password is hashed with bcrypt before storage and is never readable back, emailProtected (on by default) makes a visitor state an address, allowList/denyList narrow which addresses pass, allowDownload (off by default) governs downloads, and expiresAt closes the link. The target room or document must exist in the caller's own store or it is not found.

Creating a link also writes dataroom's ONE cross-tenant row: the link id to owning org mapping an anonymous visitor is routed through. That write is part of the operation — if it fails the call is 500 — so a link that no visitor could open is never handed back as usable.

The address a visitor later states is recorded UNVERIFIED, so a link gated only by email is openable by anyone the link reaches. Use a password for a link that must not travel.

Request

9 fields, body application/json (required).

Field	In	Type	Required	Description
`allowDownload`	body	any	—	AllowDownload permits downloading rather than viewing only.
`allowList`	body	any[]	—	AllowList narrows which addresses pass the email gate.
`dataroomId`	body	any	—	DataroomId is the room to share.
`denyList`	body	any[]	—	DenyList rejects addresses, in the same three forms as the allow list.
`documentId`	body	any	—	DocumentId shares a SINGLE document instead of a room.
`emailProtected`	body	any	—	EmailProtected makes a visitor state an address before entering.
`expiresAt`	body	any	—	ExpiresAt closes the link, in unix milliseconds.
`name`	body	any	—	Name labels the link.
`password`	body	any	—	Password gates the link.

Response

Status	Body	Meaning
`200`	dataroom.dataroomLinkOne	ok
`default`	problem-details	refused

200 body — 15 fields.

Field	In	Type	Always	Description
`link`	body	dataroom.dataroomLink	—
`link.allowDownload`	body	boolean	—	AllowDownload is whether a visitor may download, rather than only view.
`link.allowList`	body	string[]	—	AllowList narrows which addresses pass the email gate.
`link.createdAt`	body	integer (int64)	—	CreatedAt is when the link was minted, in unix milliseconds.
`link.dataroomId`	body	string	—	DataroomId is the room the link opens, null for a single-document link.
`link.denyList`	body	string[]	—	DenyList rejects addresses, in the same three forms as the allow list, and is checked BEFORE it — so deny always wins.
`link.documentId`	body	string	—	DocumentId is the document the link opens, null for a room link.
`link.emailProtected`	body	boolean	—	EmailProtected is whether a visitor must state an address to enter.
`link.expiresAt`	body	integer (int64)	—	ExpiresAt is when the link closes, in unix milliseconds; null never expires.
`link.hasPassword`	body	boolean	—	HasPassword reports THAT a password is set.
`link.id`	body	string	—	ID is the link id — the public token a visitor opens the room with.
`link.isArchived`	body	boolean	—	IsArchived is whether the link has been retired.
`link.linkType`	body	string	—	LinkType is DATAROOM_LINK or DOCUMENT_LINK.
`link.name`	body	string	—	Name is the link's label, null when none was given.
`link.updatedAt`	body	integer (int64)	—	UpdatedAt is when the link last changed, in unix milliseconds.

Failure carries the platform error shape — see Errors.

Examples

CLI

SDK

HTTP

MCP

hanzo dataroom links create

.ts

.py

.go

.rs

.java

import { Configuration, DataroomApi } from 'hanzoai';

const api = new DataroomApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postDataroomLinks({ allowDownload: "<allowDownload>", allowList: ["<allowList>"] });

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import DataroomApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = DataroomApi(client).post_dataroom_links(allow_download="<allowDownload>", allow_list=["<allowList>"])

cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.DataroomAPI.PostDataroomLinks(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_client::apis::{configuration::Configuration, dataroom_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = dataroom_api::post_dataroom_links(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.DataroomApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new DataroomApi(client).postDataroomLinks();

curl -X POST https://api.hanzo.ai/v1/dataroom/links \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "allowDownload": "<allowDownload>",
       "allowList": [
         "<allowList>"
       ]
     }'

MCP reaches dataroom through the dataroom tool, which names its 19 operations with its own verbs — this one among them, under a name only MCP declares. describe explains any of them:

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "get_dataroom_analytic_dataroom"
         }
       }
     }'

Dataroom API · All Hanzo APIs · Interactive reference

Was this page useful?

PreviousCreate documents — POST /v1/dataroom/documents NextCreate artifacts