# shares.create

`POST /api/public/v1/shares`

Create an encrypted copy of a profile for one recipient email, pinned to its latest committed revision. Session data (cookies, storage) also needs share.session; saved passwords need profile.export_sensitive. A machine of this workspace prepares it; it can be accepted until expires_in_days (1–30).

- Capability: `share.manage`
- Command: yes — send a `command_id`; resending the same id and body returns the stored receipt
- MCP tool: `shares_create`

## Parameters

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `command_id` | body | string (uuid) | yes | Client-generated UUID for this command. Send the same id (and body) again to get the stored receipt instead of a second change; a different body under the same id is CONFLICT. |
| `profile_id` | body | string (uuid) | yes | Profile to copy; its latest committed revision is used |
| `recipient_email` | body | string (email) | yes | The one person who may accept it (their verified sign-in email) (max length 320) |
| `categories` | body | array<"cookies" \| "local_storage" \| "indexed_db" \| "service_workers" \| "extensions" \| "bookmarks" \| "history" \| "open_tabs" \| …> | no | Browser data to include beyond the configuration (always included). Only categories the pinned revision holds; see shares.preview (max 9 items) Default: `[]`. |
| `expires_in_days` | body | integer | no | Days the recipient has to accept (min 1, max 30) Default: `7`. |
| `message` | body | string | no | Short note shown to the recipient (no secrets) (max length 500) |

## Response

`201` with `{ data, replayed: false, correlation_id }` the first time; `200` with `replayed: true` for a repeated `command_id`.

| Field | Type | Always present | Description |
|---|---|---|---|
| `data` | object | yes |  |
| `data.package` | object | yes |  |
| `data.package.id` | string (uuid) | yes |  |
| `data.package.state` | "preparing" \| "available" \| "importing" \| "delivered" \| "declined" \| "revoked" \| "expired" \| "failed" | yes |  |
| `data.package.profile_name` | string | yes |  |
| `data.package.os` | "windows" \| "linux" | yes |  |
| `data.package.source_revision` | integer | no | Committed revision the copy is pinned to (absent for configuration-only copies) (min -9007199254740991, max 9007199254740991) |
| `data.package.categories` | array<"cookies" \| "local_storage" \| "indexed_db" \| "service_workers" \| "extensions" \| "bookmarks" \| "history" \| "open_tabs" \| …> | yes | Browser data carried beyond the configuration |
| `data.package.recipient_email` | string | yes |  |
| `data.package.message` | string | no |  |
| `data.package.expires_at` | string (date-time) | yes |  |
| `data.package.created_at` | string (date-time) | yes |  |
| `data.package.delivered_at` | string (date-time) | no |  |
| `data.package.ended_at` | string (date-time) | no |  |
| `data.package.failure` | object | no |  |
| `data.package.failure.code` | string | yes |  |
| `data.package.failure.message` | string | no |  |
| `data.package.progress` | object | no |  |
| `data.package.progress.waiting_for_machine` | boolean | yes |  |
| `data.package.progress.phase` | string | no |  |
| `data.package.progress.pct` | integer | no | (min -9007199254740991, max 9007199254740991) |
| `data.package.progress.attempts` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data.package.profile_id` | string (uuid) | no | Absent once the source profile was deleted |
| `data.package.created_by_email` | string | no |  |
| `correlation_id` | string (uuid) | yes |  |
| `replayed` | boolean | no | true when this command_id was already applied and the stored receipt came back |

New fields can appear at any time; ignore the ones you do not know.

## Errors

| Code | HTTP | Retryable |
|---|---|---|
| `UNAUTHENTICATED` | 401 | no |
| `FORBIDDEN` | 403 | no |
| `RATE_LIMITED` | 429 | yes |
| `VALIDATION_FAILED` | 422 | no |
| `CONFLICT` | 409 | no |
| `OUTCOME_UNKNOWN` | 202 | yes |
| `DEPENDENCY_UNAVAILABLE` | 503 | yes |
| `UNKNOWN` | 500 | no |

## Example (curl)

```bash
curl -X POST "https://browlix.com/api/public/v1/shares" \
  -H "Authorization: Bearer $BROWLIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"command_id":"<uuid>","profile_id":"<profile_id>","recipient_email":"<recipient_email>"}'
```

## Example (TypeScript SDK)

```ts
import { Browlix } from "@browlix/sdk";

const bx = new Browlix({ apiKey: process.env.BROWLIX_API_KEY! });
const reply = await bx.call("shares.create", { body: {"profile_id":"<profile_id>","recipient_email":"<recipient_email>"} });
console.log(reply.data);
```

## Example (Python)

```python
import os, uuid
import requests

r = requests.post(
    "https://browlix.com/api/public/v1/shares",
    headers={"Authorization": f"Bearer {os.environ['BROWLIX_API_KEY']}"},
    json={"command_id":str(uuid.uuid4()),"profile_id":"<profile_id>","recipient_email":"<recipient_email>"},
    timeout=60,
)
print(r.status_code, r.json())
```

## Example (MCP)

```json
{
  "method": "tools/call",
  "params": {
    "name": "shares_create",
    "arguments": {
      "profile_id": "<profile_id>",
      "recipient_email": "<recipient_email>"
    }
  }
}
```