Signed links

Storages are private: reading them needs a token of the account that owns them. To hand results to someone or something without a token (a spreadsheet import, a BI tool, a client), use the storage's signed link.

Get a link

Every storage object carries a ready-made link:

Storage	Field	Opens
Dataset	items_public_url	GET /datasets/{id}/items?signature=…
Key-value store	keys_public_url	GET /key-value-stores/{id}/keys?signature=…

Get a dataset's public link

curl https://lantfly.com/api/v3/datasets/$DATASET_ID \
  -H "Authorization: Bearer $LANTFLY_TOKEN"

Answer (excerpt)

{
  "data": {
    "id": "c2f3…",
    "kind": "datasets",
    "item_count": 1240,
    "items_public_url": "https://lantfly.com/api/v3/datasets/c2f3…/items?signature=…"
  }
}

Anyone with the link can read the items, with every option the endpoint takes:

CSV of two fields, no token

curl "$ITEMS_PUBLIC_URL&format=csv&fields=url,text"

Request queues have no public links.

Expiry

Link	Expires
items_public_url, keys_public_url	After 7 days (168 hours) by default. Read the storage again for a fresh link.
A single key-value record's ?signature=	Never on its own. Rotate the key to end it.

Errors

Case	Answer
Wrong or expired signature	403 invalid_signature
No token and no signature on a private storage	401

Revoke links: rotate the signing key

Each dataset and key-value store has its own signing key. Rotating it ends every link already handed out for that storage, including record signatures, and returns the storage with new links:

Rotate a dataset's signing key

curl -X POST https://lantfly.com/api/v3/datasets/$DATASET_ID/rotate-signing-key \
  -H "Authorization: Bearer $LANTFLY_TOKEN"

The same works at POST /key-value-stores/{id}/rotate-signing-key. It needs write access to storage (storages.write on a scoped token, Write storage in an organization role). A run token can't rotate keys. Limit: 20 a minute.

warning

Rotate the key as soon as a link leaks. Waiting for expiry isn't enough: record signatures never expire on their own.

General access

Instead of signatures, an account can let anyone with a storage's ID read dataset items, key-value store keys and records without a token or signature. Set it in the Console under Settings → Login & privacy, or with:

Allow reading by ID

curl -X PUT https://lantfly.com/api/v3/account/general-access \
  -H "Authorization: Bearer $LANTFLY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"general_access": "ANYONE_WITH_ID_CAN_READ"}'

Value	Meaning
RESTRICTED	Default. A token or a valid signature is needed.
ANYONE_WITH_ID_CAN_READ	Anyone who knows the ID can read.

In an organization only owners and admins can change it, and it needs a recent sign-in (403 reauth_required otherwise).

danger

ANYONE_WITH_ID_CAN_READ applies to every storage of the account. Prefer signed links, which you can revoke one storage at a time.

Related

• Datasets
• Errors