API Reference

Capabilities

GET /v1/capabilities — what a key may do, and the plan behind it.

GET /v1/capabilities returns what the key in use may do. It needs no scope, so a key provisioned for one task can still learn its limits.

curl https://api.credenshare.io/v1/capabilities \
  -H "Authorization: Bearer crs_sk_live_<keyId>.<authSecret>"

{
  "api_version": "1",
  "key": { "key_id": "…", "scopes": ["shares:write", "audit:read"], "custody_level": 0, "organization_id": null, "rate_limit_rpm": 100 },
  "plan": { "code": "business", "name": "Business" },
  "limits": { "max_shares": 500, "remaining_shares": 346, "max_fields": 20, "max_days_access_logs": 90, "max_api_keys": 10, "max_webhooks": 5 },
  "features": { "secure_requests": true, "view_protection": true, "secure_view_prompt": true, "zero_knowledge": true },
  "sharing_policy": null,
  "field_types": ["text", "password", "date", "multiline", "markdown", "source_code", "url", "qr"],
  "notify_on_events": ["viewed", "denied", "expired", "deleted"]
}

The numbers above are an example; each plan's are on Plans and limits.
A team key reports its team's plan; a personal key, the account's. Negotiated limits are included.
In limits, -1 is unlimited.
sharing_policy is the team's sharing policy for a team key, so a client can meet it before creating anything, and null for a personal key.
Each response carries a weak ETag; If-None-Match with it answers 304.

Expire or delete a request

DELETE /v1/requests/{shortCode} — close a collect link, and once the request has expired, remove the request record.

Stats

GET /v1/stats — the account's share counts and a 14-day view history, without paging the whole share list.