# Create links URL: https://docs.hanzo.ai/docs/openapi/dataroom/post-dataroom-links > Grants access: it mints a public share link over one data room (`dataroomId`) or one document (`documentId`) — one of the two is required — and answers with the link, whose `id` is the token a visitor opens it with. `POST /v1/dataroom/links` > [Dataroom →](https://docs.hanzo.ai/docs/openapi/dataroom) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | ---------------------------------------- | | **Address** | `https://api.hanzo.ai/v1/dataroom/links` | | **Method** | `POST` | | **Operation** | `post_dataroom_links` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | Grants access: it mints a public share link over one data room (`dataroomId`) or one document (`documentId`) — one of the two is required — and answers with the link, whose `id` is the token a visitor opens it with. This is how a party is let in. The controls are declared HERE and enforced on the viewer surface: `password` is hashed with bcrypt before storage and is never readable back, `emailProtected` (on by default) makes a visitor state an address, `allowList`/`denyList` narrow which addresses pass, `allowDownload` (off by default) governs downloads, and `expiresAt` closes the link. The target room or document must exist in the caller's own store or it is not found. Creating a link also writes dataroom's ONE cross-tenant row: the link id to owning org mapping an anonymous visitor is routed through. That write is part of the operation — if it fails the call is 500 — so a link that no visitor could open is never handed back as usable. The address a visitor later states is recorded UNVERIFIED, so a link gated only by email is openable by anyone the link reaches. Use a password for a link that must not travel. ## Request 9 fields, body `application/json` (required). | Field | In | Type | Required | Description | | ---------------- | ---- | ------ | -------- | ---------------------------------------------------------------------- | | `allowDownload` | body | any | — | AllowDownload permits downloading rather than viewing only. | | `allowList` | body | any\[] | — | AllowList narrows which addresses pass the email gate. | | `dataroomId` | body | any | — | DataroomId is the room to share. | | `denyList` | body | any\[] | — | DenyList rejects addresses, in the same three forms as the allow list. | | `documentId` | body | any | — | DocumentId shares a SINGLE document instead of a room. | | `emailProtected` | body | any | — | EmailProtected makes a visitor state an address before entering. | | `expiresAt` | body | any | — | ExpiresAt closes the link, in unix milliseconds. | | `name` | body | any | — | Name labels the link. | | `password` | body | any | — | Password gates the link. | ## Response | Status | Body | Meaning | | --------- | ------------------------ | ------- | | `200` | dataroom.dataroomLinkOne | ok | | `default` | problem-details | refused | `200` body — 15 fields. | Field | In | Type | Always | Description | | --------------------- | ---- | --------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------- | | `link` | body | dataroom.dataroomLink | — | | | `link.allowDownload` | body | boolean | — | AllowDownload is whether a visitor may download, rather than only view. | | `link.allowList` | body | string\[] | — | AllowList narrows which addresses pass the email gate. | | `link.createdAt` | body | integer (int64) | — | CreatedAt is when the link was minted, in unix milliseconds. | | `link.dataroomId` | body | string | — | DataroomId is the room the link opens, null for a single-document link. | | `link.denyList` | body | string\[] | — | DenyList rejects addresses, in the same three forms as the allow list, and is checked BEFORE it — so deny always wins. | | `link.documentId` | body | string | — | DocumentId is the document the link opens, null for a room link. | | `link.emailProtected` | body | boolean | — | EmailProtected is whether a visitor must state an address to enter. | | `link.expiresAt` | body | integer (int64) | — | ExpiresAt is when the link closes, in unix milliseconds; null never expires. | | `link.hasPassword` | body | boolean | — | HasPassword reports THAT a password is set. | | `link.id` | body | string | — | ID is the link id — the public token a visitor opens the room with. | | `link.isArchived` | body | boolean | — | IsArchived is whether the link has been retired. | | `link.linkType` | body | string | — | LinkType is DATAROOM\_LINK or DOCUMENT\_LINK. | | `link.name` | body | string | — | Name is the link's label, null when none was given. | | `link.updatedAt` | body | integer (int64) | — | UpdatedAt is when the link last changed, in unix milliseconds. | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo dataroom links create ``` **SDK** **.ts** ```ts import { Configuration, DataroomApi } from 'hanzoai'; const api = new DataroomApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.postDataroomLinks({ allowDownload: "", allowList: [""] }); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import DataroomApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = DataroomApi(client).post_dataroom_links(allow_download="", allow_list=[""]) ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.DataroomAPI.PostDataroomLinks(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, dataroom_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = dataroom_api::post_dataroom_links(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.DataroomApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new DataroomApi(client).postDataroomLinks(); ``` **HTTP** ```bash curl -X POST https://api.hanzo.ai/v1/dataroom/links \ -H "Authorization: Bearer $HANZO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "allowDownload": "", "allowList": [ "" ] }' ``` **MCP** MCP reaches **dataroom** through the `dataroom` tool, which names its 19 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "get_dataroom_analytic_dataroom" } } }' ``` --- [Dataroom API](https://docs.hanzo.ai/docs/openapi/dataroom) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)