# Sharing and access ## Tools A public link opens the object at its own address, read-only and with no account. Editing always requires workspace membership. Requesting access and moving ownership happen in the web app. | Tool | What it does | | |---|---|---| | [`set_sharing`](#set_sharing) | Set sharing | Destructive write | ## set_sharing `Destructive write` · `Idempotent` Turn the public link of a dashboard, chat, skill OR notebook on or off (`publicLink`), or set who its embed serves (`embed`): exactly one of dashboardId/chatId/skillId/notebookId, plus either or both. The address is the object's own and never changes. Each field's description holds its rules. Setting the current state changes nothing. get_dashboard, get_skill and get_notebook report `publicLink`, `embed` and `url`; a chat has no reader. Sharing grants viewing only; to let someone EDIT, invite them to the workspace. Dashboards, skills and notebooks need edit access on the object (owner, editor grantee, editor workspace default, or workspace admin); a chat only its owner, and a view-only member may turn their chat's link or embed off but never on. Guests can do neither. ### `publicLink` true or false turns the object's public link on or off. On, anyone holding the object's address opens a read-only view with no account. The address is {origin}/dashboards/{id}, /chats/{id}, /skills/{id} or /notebooks/{id}, so off-then-on brings back the same URL; there is no rotating it. On also sets the embed to anyone, replacing a website or access embed; off leaves a website or access embed alone. The reply carries `enabled`, `embed` (who the embed now serves: off, anyone, website or access), the `url`, and when turned on `embedUrl` ({origin}/embed/dashboards/{id}, /embed/chats/{id}, /embed/skills/{id} or /embed/notebooks/{id}), the same view chromeless for an iframe (?header=0 on it hides the frame's header too). Turning on is refused when the workspace admin has turned public links off, and on an archived item; turning off always works. Dashboard links show the published baseline (last refresh at default parameters) with a "data as of" stamp — no editing, filters or chat. Chat links show the conversation live, read-only. Skill links render the skill's markdown, live. Notebook links render prose, cells (a data cell as its read-only form) and the last run's outputs, figures and large tables included, with no Run control. ### `embed` Who the object's embed serves. `anyone` is the public link itself (`publicLink: true`), so anyone holding the address opens it. `website` serves a frame only to a host page whose server signs a short-lived token with one of the object's embed keys (Settings → Embed), with no viewer named. `access` serves only people who can already read the object: they sign in with their Vistazo account inside the frame (every plan), or the host's server signs a token naming the viewer (the host's SSO sign-in, Enterprise plan). `off` turns the embed off, and the public link with it. One audience at a time: setting `website` or `access` turns the public link off. Keys survive a change of audience, so switching back restores a host's embed. The reply carries `embed`, the `url`, and while the embed is on `embedUrl` ({origin}/embed/dashboards/{id}, /embed/chats/{id}, /embed/skills/{id} or /embed/notebooks/{id}) — the address a host frames, with its token for website or the SSO sign-in. Adding header=0 to it (?header=0, or &header=0 after a token) hides the frame's header: the logo, name, timestamp and open-in-new-tab. `anyone` and `website` are refused when the workspace admin has turned public links off; every audience but `off` is refused on an archived item; `off` always works.