Share links
What this page is — sending one document outside your organisation as a tracked, expiring, revocable link instead of an attachment. It covers both ways to send: a link you paste yourself, and an email Orbit sends for you.
What it is for — so a document can leave your organisation in a form you can track, expire and take back.
The problem it solves — an attached PDF is gone the moment it is sent — you cannot withdraw it, see whether it was opened, or stop it being forwarded.
Route: the Distribution panel on /org/papers/documents/<document>; the recipient opens
/papers/shared/<token> · Permission: Distribute documents externally. to send; none to open
1. What it is
Every send creates a distribution row on the document. The row holds its channel, its expiry, and view and download counters, and it is either active, expired or revoked. Two buttons create them:
| Email Document | Create Share Link | |
|---|---|---|
| Who it reaches | Named recipients, one tracked link each | Whoever you give the link to |
| Who delivers it | Orbit sends the email | You paste the link — chat, your own mail, a ticket |
| Passcode | No | Optional |
| View-only option | No | Yes |
| Rows created | One per recipient | One |
Both channels open the same recipient page. Both show the document's sealed PDF, never a live render.
2. Why you would use it
- You can take it back. An attachment is gone the moment you send it. A link can be revoked, and the next open fails.
- You know it was read. "Did you get the contract?" becomes a glance at the view counter and the first-viewed time.
- Stale access cleans itself up. Links expire on their own — 14 days by default — so a supplier from two years ago cannot still open your pricing schedule.
- What they see cannot drift from what you approved. The recipient views the sealed file, the same bytes the verification page fingerprints.
3. Step by step
Emailing it
- On the document, open Distribution → Email Document.
- Enter the recipients, separated by commas, semicolons or new lines.
- Optionally add a message. The AI cover-note button drafts one for you, using AI credits.
- Send. Each recipient receives their own tracked link to the latest sealed PDF, so views are counted per person.
If some addresses fail to send, the toast lists them — "Sent, but 2 email(s) failed: …". The others are still delivered.
Creating a link
- Distribution → Create Share Link.
- Set Expires in (days), an optional Passcode, and Allow download.
- Create, then copy the link from the drawer. The panel explains: "Anyone with the link (and passcode, if set) can view the sealed PDF."
The panel lets you email or link a document that has never been finalized. The send succeeds, but there is no sealed PDF to show, so the recipient sees "Link not found — This share link is invalid or no longer exists", and a fresh link fails the same way. Always finalize the document before you send it.
4. Field reference
| Field | Control | Default | Validation and effect |
|---|---|---|---|
| Recipients | Text, list | — | "At least one recipient email is required"; a bad address gives invalid recipient email "…" |
| Message | Text | Empty | Included in the email body |
| Expires in | Number of days | 14 | Maximum 365 — "expires_days must be at most 365" |
| Passcode | Text | Empty | Stored hashed. It is never part of the link, so send it by a different channel |
| Allow download | Switch | On | Off hides Download. Two rules override it, below |
When download is refused whatever you choose
| Rule | Where it is set |
|---|---|
The type turns allow_download off | Behaviour settings — every link on that type becomes view-only |
| The document is confidential | Its confidentiality level — no download URL is ever issued |
View-only is still a deterrent, not a guarantee. It removes the button, but it cannot stop a screenshot.
5. What the recipient sees, and what each message means
| Page shows | Cause |
|---|---|
| The PDF with Shared by, the number and link valid until | The link is valid |
| An access-code prompt | A passcode was set. A wrong one shows "Incorrect access code — try again." |
| This link is no longer available + "This share link has expired." | Past its expiry. It is flipped to expired the first time someone opens it late |
| … + "The issuer has revoked this share link." | You revoked this link |
| … + "The issuer has revoked this document." | The whole document was revoked, which kills every link |
| Link not found | The token is wrong — or the document had no sealed PDF (§3) |
| Could not reach the server | The request never completed, e.g. an offline client or a proxy. The link may be fine |
The link is built on your organisation's own host: a custom papers domain if one is set, otherwise your subdomain, otherwise the platform address.
6. Worked example
The finance team sends Acme's auditor the signed Master Services Agreement MSA-2026-031.
- Create Share Link: expires in 21 days, passcode
acme-audit-21, Allow download off. - They paste the link in the audit portal and read the passcode out on the kick-off call.
- Two days later, the distribution list shows the eye icon at 3 views, first viewed Tuesday 10:14. The arrow counter stays at 0 — no downloads, as intended.
- The engagement ends early, so they click ✕ on the row and confirm. The auditor's next open shows "The issuer has revoked this share link." The row stays in the list as revoked, and Activity records who revoked it.
If the MSA had been marked confidential, step 1's download switch would not have mattered — it would be view-only anyway.
7. The admin contract
| What must be configured | Otherwise |
|---|---|
| Distribute documents externally. on the sender's role | The Distribution panel's send buttons are absent |
| Outbound email for the organisation | Email sends report failures; links still work |
| A custom papers domain or subdomain, if you want your own host | Links use the platform address |
The type's allow_download | Downloads allowed on every link unless the sender turns them off |
8. Downstream
- The document's Activity records the distribution, every link viewed, and every link revoked.
- Revoking the document (reason required; refused under legal hold) ends every link at once.
- Superseding a document does not end its links. Revoke them yourself if the old copy must stop circulating.
- Expiry does most of the cleaning — far more links end by expiring than by being revoked, so choose the expiry deliberately.
9. Don't confuse this with…
| Counterparty portal | Lets the other side comment, redline and accept. A share link is read-only |
| Verification | Confirms authenticity and shows nobody the contents |
| Public library | Open to anyone, with no expiry and no counters |
| Lifecycle "send" steps | Record a state change only — nothing is emailed and nothing is shared |
10. Troubleshooting
| Symptom | Cause |
|---|---|
| Recipient sees Link not found on a link you just made | The document was never finalized — finalize it and send a new link |
| No Download button although you allowed it | The document is confidential, or its type forces view-only |
| The counter shows views you did not expect | The link was forwarded — revoke it and send per-recipient emails instead |
| Old links still work after superseding | Expected — only revoke ends them |
| Create Share Link refuses | Expiry above 365 days |