ts share

Show or revoke a share link — the URL that lets someone launch one workspace app without going through the Portal themselves.

Usage

ts shares <workspace>
ts share <id>
ts share delete <id> [--force]

Description

A share link points at a single app in a single workspace. Depending on how it was made it either still requires a sign-in or allows anonymous visitors, which is the column to look at first when you are auditing what a workspace has handed out. Share links are created and edited elsewhere; ts only reads them and revokes them, so there is no new or set action here.

ts shares takes a workspace — GUID or friendly id — and it is required, because the server has no list-all-share-links endpoint. There is no way to sweep an entire deployment in one call; loop over the output of ts workspaces if that is what you need. The listing gives the share id, the link's name, the app it launches, whether anonymous access is allowed, and when it was created.

ts share <id> prints those same fields for one link as labeled lines rather than as a JSON document, so it is meant for reading, not for piping into another command. Use --format=json if you need it structured.

Both commands need a service credential. The share endpoints require the share:read and share:manage service scopes, and a user ticket does not carry them — not even a Server Administrator's. Run these with --local on the server itself; a remote login is refused with a message naming the missing scope. This is the same shape as ts runner <id>.

ts share delete revokes the link. The link is marked revoked rather than erased, and every lookup filters revoked links out, so from that moment the URL no longer resolves for anyone holding it — including anonymous visitors who never signed in and have no other way back to the app. There is no un-revoke: re-sharing the app produces a new link with a new id, and the old URL stays dead. The command prompts unless you pass --force.

Two things revoking does not do. It does not touch sessions that were already launched through the link — end those with ts session if that is the point. And it is not recorded in the audit log; the audit trail covers artifact share links, not these, so the only trace of a revocation is the link's disappearance from ts shares. Note the share id and name somewhere before you revoke if you may need to account for it later.

Options

Flag	Description	Default/Values	Notes
--force, -f	Revoke without confirming.		delete only. Also required when running non-interactively.
--local	Target the install on this machine with a service token.		Required in practice: both ts share and ts shares reject an ordinary login.

Examples

# What has this workspace handed out?
ts shares --local engineering

# Anything anonymous in there? Full ids and names, untruncated
ts shares --local engineering --no-trunc

# One link in detail
ts share --local 7Kq2vN4pXb

# The same fields, structured
ts share --local 7Kq2vN4pXb --format=json

# Revoke a link that should not have been created
ts share delete --local 7Kq2vN4pXb --force

# Gotcha: revoking is one-way and unlogged. The URL stops working for everyone
# immediately, re-sharing mints a different id, and nothing in the audit log
# records that you did it — write down the id and name first.

Exit Codes

0 on success. -1 when no share id is given, and when a revoke is declined at the prompt or run non-interactively without --force. -2 when ts shares is run without a workspace, which is a parse error rather than a server response. -4 when no account is signed in, and also on any of these commands with an ordinary login, because the endpoints require a service credential — the message names the scope that was missing. -6 when no share link has that id, when it has already been revoked, and when the named workspace does not exist.

Related Commands

• ts workspace — The workspace whose links you are listing, and the source of the workspace argument.
• ts app — The app a share link launches.
• ts session — Sessions started through a link; revoking does not end them.
• ts audit — The audit trail, which does not cover these revocations.