Sign share media again
Mints fresh signed URLs for files and optionally the ZIP and the thumbnails (signed URLs expire). PUBLIC links need nothing; PRIVATE links need the share cookie from unlock.
Try the REST routes against the public demo at https://demostash.aldyernesto.my.id. Get a read-only token (valid for 60 minutes), then paste it as the Bearer token in the console of any route.
/s/{slug}/signNo try-it console: the demo answers cross-origin requests on /api only.Mints fresh signed URLs for files and optionally the ZIP and the thumbnails (signed URLs expire). PUBLIC links need nothing; PRIVATE links need the share cookie from unlock.
ShareCookieshotstash_share_{slug}<token>Access to a PRIVATE share link, set by POST /s/{slug}/unlock and scoped to /s/{slug}. The real cookie name ends with the link slug. PUBLIC links need no cookie.
slug*stringShare link slug.
application/json- body
fileIds?array<string>|Files to sign (at most 200).
zip?|Also sign the ZIP of the link or of section.
section?|Section id for the ZIP and the thumbnails.
thumbs?|Also sign the stage and Section card thumbnails.
Fresh signed URLs
application/json- response
files*Signed URLs by file id.
zipUrl*|Signed ZIP URL, or null when not asked or not possible.
cause*|Why the ZIP could not be signed.
"EMPTY""UNREADABLE""NOT_FOUND"nullstageThumbs*array<string|null>|Signed stage thumbnails, when asked.
sectionThumbs*|Signed Section card thumbnails by Section id, when asked.
curl -X POST "https://example.com/s/string/sign" \ -H "Content-Type: application/json" \ -d '{}'{ "files": { "property1": { "thumbnailUrl": "string", "inlineUrl": "string", "downloadUrl": "string" }, "property2": { "thumbnailUrl": "string", "inlineUrl": "string", "downloadUrl": "string" } }, "zipUrl": "string", "cause": "EMPTY", "stageThumbs": [ "string" ], "sectionThumbs": { "property1": [ "string" ], "property2": [ "string" ] }}Next page of a share grid GET
One more page of files or Sections with signed media URLs. PUBLIC links need nothing; PRIVATE links need the share cookie from unlock.
Unlock a share link POST
Checks the access code of a PRIVATE link and sets the shotstash_share_<slug> cookie (HttpOnly; Path=/s/<slug>); answers the page. PUBLIC links answer the page without a code. 5 attempts per 15 minutes per IP and 20 per hour per link.