---
title: "Sharing"
description: "Every operation in this group: what it accepts, what it returns and the errors it can answer with."
url: "https://nextmail.sh/docs/api/reference/sharing"
area: "API"
category: "Reference"
---

# Sharing

Every operation in this group: what it accepts, what it returns and the errors it can answer with.

## Operations

Public links to templates, forms and automations, the Share button on each of them in the app. Everything is private until it is shared, and a shared item is a page anyone with the link can open without an account, where they can try it: fill in a template's props, type into a form, follow an automation step by step. With `copyable` on, anyone signed in can also copy it into their own workspace.

A copy carries the design only: never the submissions, sends, runs or contacts the original collected, and never the audiences, addresses, forms or webhook endpoints it points at, which stay with the owner and are left empty for you to fill in. The templates an automation sends are copied with it, and the images a template shows are copied into your workspace.

### `GET /share-links`

List the public links

Every template, form and automation of this workspace that is public, newest link first, with how often each was opened and copied. `kind` keeps one of the three. A key sees the kinds its scopes read: `templates:read` for templates, `forms:read` for forms and `automations:read` for automations, and the others are left out. A member's token sees the templates and the forms and automations that member made.

Requires the `templates:read` scope, or `forms:read` or `automations:read` in its place.

- Scopes: `templates:read`.

**Query parameters**

- `kind` (`string`, one of `"template"`, `"form"`, `"automation"`): Only links to this kind of item. Left out, all three.
- `limit` (`integer`, at least 1, at most 100, default `50`): Rows per page, 1 to 100.
- `cursor` (`string`): The id of the last link on the previous page. Keyset, not offset: pass the previous page's `nextCursor`. One that names nothing in this list is a 400 `invalid_cursor`.

**Returns**

- `200` `ShareLinkList`: A page of public links, newest first.

**Errors**

- The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors).

Also available in: TypeScript [`shareLinks.list()`](https://nextmail.sh/docs/sdk/reference/share-links#list), [`shareLinks.listAll()`](https://nextmail.sh/docs/sdk/reference/share-links#listAll), [`shareLinks.iterate()`](https://nextmail.sh/docs/sdk/reference/share-links#iterate); Python [`share_links.list()`](https://nextmail.sh/docs/python/reference/share-links#list), [`share_links.list_all()`](https://nextmail.sh/docs/python/reference/share-links#listAll), [`share_links.iterate()`](https://nextmail.sh/docs/python/reference/share-links#iterate); Ruby [`share_links.list`](https://nextmail.sh/docs/ruby/reference/share-links#list), [`share_links.list_all`](https://nextmail.sh/docs/ruby/reference/share-links#listAll), [`share_links.iterate`](https://nextmail.sh/docs/ruby/reference/share-links#iterate); PHP [`shareLinks->list`](https://nextmail.sh/docs/php/reference/share-links#list), [`shareLinks->listAll`](https://nextmail.sh/docs/php/reference/share-links#listAll), [`shareLinks->iterate`](https://nextmail.sh/docs/php/reference/share-links#iterate); Go [`ShareLinks.List`](https://nextmail.sh/docs/go/reference/share-links#list), [`ShareLinks.ListAll`](https://nextmail.sh/docs/go/reference/share-links#listAll), [`ShareLinks.Iterate`](https://nextmail.sh/docs/go/reference/share-links#iterate); Java [`shareLinks().list`](https://nextmail.sh/docs/java/reference/share-links#list), [`shareLinks().listAll`](https://nextmail.sh/docs/java/reference/share-links#listAll), [`shareLinks().iterate`](https://nextmail.sh/docs/java/reference/share-links#iterate); C# [`ShareLinks.ListAsync`](https://nextmail.sh/docs/csharp/reference/share-links#list), [`ShareLinks.ListAllAsync`](https://nextmail.sh/docs/csharp/reference/share-links#listAll), [`ShareLinks.IterateAsync`](https://nextmail.sh/docs/csharp/reference/share-links#iterate); CLI [`nextmail share-links list`](https://nextmail.sh/docs/cli/reference/share-links#share-links-list); MCP [`listShareLinks`](https://nextmail.sh/docs/mcp/tools/sharing#listShareLinks).

### `GET /share-links/{kind}/{itemId}`

Read the public link of an item

The public link of one template, form or automation, with how often it was opened and copied. Reading it takes the read scope of its kind. A private item answers 404 `share_link_not_found`, and an item this workspace does not hold, or a member cannot reach, answers 404 `resource_not_found`.

Requires the `templates:read` scope, or `forms:read` or `automations:read` in its place.

- Scopes: `templates:read`.

**Path parameters**

- `kind` (`string`, required, one of `"template"`, `"form"`, `"automation"`): What the item is: `template`, `form` or `automation`.
- `itemId` (`string`, required): The template, form or automation, by the id `GET /templates`, `GET /forms` or `GET /automations` returns.

**Returns**

- `200` `ShareLink`: The public link.

**Errors**

- `404`: `share_link_not_found`: the item is private. `resource_not_found`: no such item here.
- The errors every operation can return: `400`, `401`, `403`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors).

Also available in: TypeScript [`shareLinks.get()`](https://nextmail.sh/docs/sdk/reference/share-links#get); Python [`share_links.get()`](https://nextmail.sh/docs/python/reference/share-links#get); Ruby [`share_links.get`](https://nextmail.sh/docs/ruby/reference/share-links#get); PHP [`shareLinks->get`](https://nextmail.sh/docs/php/reference/share-links#get); Go [`ShareLinks.Get`](https://nextmail.sh/docs/go/reference/share-links#get); Java [`shareLinks().get`](https://nextmail.sh/docs/java/reference/share-links#get); C# [`ShareLinks.GetAsync`](https://nextmail.sh/docs/csharp/reference/share-links#get); CLI [`nextmail share-links get`](https://nextmail.sh/docs/cli/reference/share-links#share-links-get); MCP [`getShareLink`](https://nextmail.sh/docs/mcp/tools/sharing#getShareLink).

### `PUT /share-links/{kind}/{itemId}`

Make an item public

Shares one template, form or automation at a public link, as Share does in the app, and answers the link. Sharing takes the write scope of its kind. An item that is already public keeps its link, so the call is safe to repeat: `copyable` changes whether people may copy it, and leaving it out keeps what it was, which is `true` for a new link.

The page shows what is live: a template's published version, a form's published design and an automation's published flow, or the draft when nothing was published yet. A copy carries the design only: never the submissions, sends, runs or contacts the original collected, and never the audiences, addresses, forms or webhook endpoints it points at, which stay with the owner and are left empty for you to fill in. The templates an automation sends are copied with it, and the images a template shows are copied into your workspace.

Requires the `templates:write` scope, or `forms:write` or `automations:write` in its place.

- Scopes: `templates:write`.

**Path parameters**

- `kind` (`string`, required, one of `"template"`, `"form"`, `"automation"`): What the item is: `template`, `form` or `automation`.
- `itemId` (`string`, required): The template, form or automation, by the id `GET /templates`, `GET /forms` or `GET /automations` returns.

**Request body**

- `copyable` (`boolean`): `true` lets anyone signed in copy the item into their own workspace from the page, and `false` lets people only look at it. Left out, a new link is copyable and a link that already exists keeps what it had.

**Returns**

- `200` `ShareLink`: The public link, new or as it was.

**Errors**

- `404`: `resource_not_found`: no such item here.
- The errors every operation can return: `400`, `401`, `403`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors).

Also available in: TypeScript [`shareLinks.set()`](https://nextmail.sh/docs/sdk/reference/share-links#set); Python [`share_links.set()`](https://nextmail.sh/docs/python/reference/share-links#set); Ruby [`share_links.set`](https://nextmail.sh/docs/ruby/reference/share-links#set); PHP [`shareLinks->set`](https://nextmail.sh/docs/php/reference/share-links#set); Go [`ShareLinks.Set`](https://nextmail.sh/docs/go/reference/share-links#set); Java [`shareLinks().set`](https://nextmail.sh/docs/java/reference/share-links#set); C# [`ShareLinks.SetAsync`](https://nextmail.sh/docs/csharp/reference/share-links#set); CLI [`nextmail share-links set`](https://nextmail.sh/docs/cli/reference/share-links#share-links-set); MCP [`setShareLink`](https://nextmail.sh/docs/mcp/tools/sharing#setShareLink).

### `DELETE /share-links/{kind}/{itemId}`

Make an item private

Takes the public link down, as turning Share off does in the app: the page stops working at once for everyone who has the link, and copies already made stay where they are. Making it public again gives it a new link. A private item answers 404 `share_link_not_found`.

Requires the `templates:write` scope, or `forms:write` or `automations:write` in its place.

- Scopes: `templates:write`.

**Path parameters**

- `kind` (`string`, required, one of `"template"`, `"form"`, `"automation"`): What the item is: `template`, `form` or `automation`.
- `itemId` (`string`, required): The template, form or automation, by the id `GET /templates`, `GET /forms` or `GET /automations` returns.

**Returns**

- `200` `DeletedShareLink`: The link that stopped working.

**Errors**

- `404`: `share_link_not_found`: the item is already private. `resource_not_found`: no such item here.
- The errors every operation can return: `400`, `401`, `403`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors).

Also available in: TypeScript [`shareLinks.delete()`](https://nextmail.sh/docs/sdk/reference/share-links#delete); Python [`share_links.delete()`](https://nextmail.sh/docs/python/reference/share-links#delete); Ruby [`share_links.delete`](https://nextmail.sh/docs/ruby/reference/share-links#delete); PHP [`shareLinks->delete`](https://nextmail.sh/docs/php/reference/share-links#delete); Go [`ShareLinks.Delete`](https://nextmail.sh/docs/go/reference/share-links#delete); Java [`shareLinks().delete`](https://nextmail.sh/docs/java/reference/share-links#delete); C# [`ShareLinks.DeleteAsync`](https://nextmail.sh/docs/csharp/reference/share-links#delete); CLI [`nextmail share-links delete`](https://nextmail.sh/docs/cli/reference/share-links#share-links-delete); MCP [`deleteShareLink`](https://nextmail.sh/docs/mcp/tools/sharing#deleteShareLink).

### `GET /shared/{token}`

Read a shared item

What the public page of a link shows, from any workspace: the item's name and description, the workspace that shares it, whether it may be copied, and its content. A template comes rendered with the sample values of its props, a form with its design, and an automation with its flow and the templates it sends. The audiences, addresses, forms and webhook endpoints an automation points at are left empty, and a form's audience choices keep their labels only. Reading it takes the read scope of the item's kind, and it does not count as a view of the page.

Requires the `templates:read` scope, or `forms:read` or `automations:read` in its place.

- Scopes: `templates:read`.

**Path parameters**

- `token` (`string`, required): The token at the end of a public link, `token` on a share link, or the last part of its `url`.

**Returns**

- `200` `SharedItem`: The shared item.

**Errors**

- `404`: `shared_item_not_found`: no shared item has that link, because the owner made it private or deleted it.
- The errors every operation can return: `400`, `401`, `403`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors).

Also available in: TypeScript [`shared.get()`](https://nextmail.sh/docs/sdk/reference/shared#get); Python [`shared.get()`](https://nextmail.sh/docs/python/reference/shared#get); Ruby [`shared.get`](https://nextmail.sh/docs/ruby/reference/shared#get); PHP [`shared->get`](https://nextmail.sh/docs/php/reference/shared#get); Go [`Shared.Get`](https://nextmail.sh/docs/go/reference/shared#get); Java [`shared().get`](https://nextmail.sh/docs/java/reference/shared#get); C# [`Shared.GetAsync`](https://nextmail.sh/docs/csharp/reference/shared#get); CLI [`nextmail shared get`](https://nextmail.sh/docs/cli/reference/shared#shared-get).

### `POST /shared/{token}/copy`

Copy a shared item into this workspace

Copies the item at a public link into this workspace as a new draft, as Copy to my workspace does on the page, and answers the copy's id. Copying takes the write scope of the item's kind, and an automation that sends templates also takes `templates:write`. A template whose name is taken here gets a number after it. Workspace limits apply as they do to anything created here.

A copy carries the design only: never the submissions, sends, runs or contacts the original collected, and never the audiences, addresses, forms or webhook endpoints it points at, which stay with the owner and are left empty for you to fill in. The templates an automation sends are copied with it, and the images a template shows are copied into your workspace.

Requires the `templates:write` scope, or `forms:write` or `automations:write` in its place.

- Scopes: `templates:write`.

**Path parameters**

- `token` (`string`, required): The token at the end of a public link, `token` on a share link, or the last part of its `url`.

**Returns**

- `201` `SharedCopy`: The copy, a draft in this workspace.

**Errors**

- `403`: `share_not_copyable`: the owner shares it to look at, not to copy.
- `404`: `shared_item_not_found`: no shared item has that link.
- The errors every operation can return: `400`, `401`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors).

Also available in: TypeScript [`shared.copy()`](https://nextmail.sh/docs/sdk/reference/shared#copy); Python [`shared.copy()`](https://nextmail.sh/docs/python/reference/shared#copy); Ruby [`shared.copy`](https://nextmail.sh/docs/ruby/reference/shared#copy); PHP [`shared->copy`](https://nextmail.sh/docs/php/reference/shared#copy); Go [`Shared.Copy`](https://nextmail.sh/docs/go/reference/shared#copy); Java [`shared().copy`](https://nextmail.sh/docs/java/reference/shared#copy); C# [`Shared.CopyAsync`](https://nextmail.sh/docs/csharp/reference/shared#copy); CLI [`nextmail shared copy`](https://nextmail.sh/docs/cli/reference/shared#shared-copy); MCP [`copySharedItem`](https://nextmail.sh/docs/mcp/tools/sharing#copySharedItem).

### Objects

#### `AutomationDefinition`

`object`

What starts an automation and what it then does. Paths never join or loop: every step is reached from exactly one place, and a definition holds at most 50 steps.

- `trigger` (`object`, required, nullable): What puts a contact into the automation. Null in a draft that has none yet, and a draft cannot be published without one.
  - `kind` (`string`, required, one of `"audience_joined"`)
  - `audienceId` (`string`, required, up to 64 characters)
  - `includeImported` (`boolean`, required)
- `entry` (`string`, required, nullable, pattern `^[a-z][a-z0-9]{2,23}$`): The `key` of the first step, or null while the draft has no steps.
- `steps` (`object[]`, required, up to 50 items): Every step, in any order. Each has a unique `key`, and names the step after it by key in `next`, or in `yes` and `no` for a branch. Null ends the path there.
  - `key` (`string`, required, pattern `^[a-z][a-z0-9]{2,23}$`)
  - `name` (`string`, up to 80 characters)
  - `kind` (`string`, required, one of `"send_email"`)
  - `next` (`string`, required, nullable, pattern `^[a-z][a-z0-9]{2,23}$`)
  - `templateId` (`string`, required, up to 64 characters)
  - `templateVersion` (`integer`, required, nullable, at least 1)
  - `from` (`object`, required)
    - `email` (`string`, required, up to 320 characters)
    - `name` (`string`, up to 120 characters)
  - `replyTo` (`string`, required, nullable, up to 320 characters)
  - `subject` (`string`, required, nullable, up to 300 characters)
  - `props` (`Record<string, object>`, required)

#### `AutomationSettings`

`object`

- `timezone` (`string`, required, 1 to 64 characters): The IANA time zone the sending window and waits until a day and time are read in, such as `Europe/London`. `UTC` until you set one.
- `sendWindow` (`object`, required, nullable): When emails may go out: `days` of the week (0 is Sunday) and `startMinute` to `endMinute` of the day, counted from midnight. An email due outside it waits for the window to open. Null sends at any time.
  - `days` (`integer[]`, required, up to 7 items)
  - `startMinute` (`integer`, required, at least 0, at most 1440)
  - `endMinute` (`integer`, required, at least 0, at most 1440)
- `reentryDays` (`integer`, required, nullable, at least 0, at most 3650): How many days after a contact finishes before they may enter again. Null lets each contact through once only.
- `exitOnLeave` (`boolean`, required): Take a contact out when they leave the audience that started the automation. True by default.
- `listAudienceId` (`string`, required, nullable, up to 64 characters): The audience an unsubscribe from one of these emails is recorded in. A contact who unsubscribed from it is not sent to and cannot be enrolled. Null uses the audience that starts the automation, or the built-in audience of every contact when no audience starts it.

#### `DeletedShareLink`

`object`

- `object` (`string`, required, one of `"share_link"`)
- `id` (`string`, required)
- `kind` (`string`, required, one of `"template"`, `"form"`, `"automation"`)
- `itemId` (`string`, required): The template, form or automation the link shows.
- `itemName` (`string`, required): Its name, as it is now.
- `token` (`string`, required): The secret part of the link. `GET /shared/{token}` and `POST /shared/{token}/copy` take it.
- `url` (`string`, required, format `uri`): The public page anyone with the link can open, without an account.
- `copyable` (`boolean`, required): True when people may copy the item into their own workspace from the page, false when they may only look at it.
- `views` (`integer`, required, at least 0): How often the public page was opened.
- `copies` (`integer`, required, at least 0): How often the item was copied into a workspace from the link.
- `lastViewedAt` (`string`, required, nullable, format `date-time`)
- `lastCopiedAt` (`string`, required, nullable, format `date-time`)
- `createdAt` (`string`, required, format `date-time`): When the item was made public at this link.
- `updatedAt` (`string`, required, format `date-time`)
- `deleted` (`boolean`, required, one of `true`)

#### `FormDocument`

`object`

Everything a visitor sees: `fields` in order, the `copy` around them and the `style`. Every form has exactly one `email` field, and every input field has a unique `key` that answers are posted under.

- `fields` (`object[]`, required, 1 to 50 items)
  - `id` (`string`, required, 1 to 64 characters)
  - `type` (`string`, required, one of `"email"`, `"text"`, `"textarea"`, `"number"`, `"phone"`, `"url"`, `"date"`, `"select"`, `"radio"`, `"checkboxes"`, `"checkbox"`, `"consent"`, `"audiences"`, `"hidden"`, `"heading"`, `"paragraph"`, `"divider"`)
  - `key` (`string`, required, up to 40 characters, pattern `^[a-z][a-z0-9_]{0,39}$`)
  - `label` (`string`, required, up to 300 characters)
  - `placeholder` (`string`, required, nullable, up to 200 characters)
  - `help` (`string`, required, nullable, up to 1000 characters)
  - `required` (`boolean`, required)
  - `defaultValue` (`string`, required, nullable, up to 1000 characters)
  - `options` (`object[]`, required, up to 50 items)
    - `id` (`string`, required, 1 to 64 characters)
    - `label` (`string`, required, 1 to 300 characters)
    - `value` (`string`, required, 1 to 1000 characters)
  - `mapsTo` (`string`, required, nullable, one of `"email"`, `"firstName"`, `"lastName"`, `"name"`, `"phone"`, `"company"`, `"jobTitle"`, `"website"`, `"birthday"`): The contact detail this field fills when the sign-up is accepted, or null for none. `email` goes on the email field. `firstName`, `lastName`, `name`, `company` and `jobTitle` go on a `text` field, `phone` on a `phone` field, `website` on a `url` field and `birthday` on a `date` field. One field per detail, and `name` never together with `firstName` or `lastName`. The name is saved on the contact. The phone number, company, job title, website and birthday are saved on the contact card, and only where the card has nothing yet: a company, job title or birthday already there is kept, and a phone number or website the card already lists is not added again.
  - `saveAs` (`string`, nullable, pattern `^[A-Za-z][A-Za-z0-9_]{0,63}$`): A custom field of the contact this field fills when the sign-up is accepted, such as `plan`, or null for none. A key starts with a letter and holds up to 64 letters, digits and underscores. The answer replaces the field of that name on the contact, an empty answer leaves it alone, and a choice of several options is saved as their labels joined by commas. Not on the email field or an audience choice, one field per custom field, and never together with `mapsTo`. Left out when a form is updated, a field keeps the custom field it had.
  - `width` (`string`, required, one of `"full"`, `"half"`)
  - `minLength` (`integer`, required, nullable, at least 0, at most 5000)
  - `maxLength` (`integer`, required, nullable, at least 1, at most 5000)
  - `min` (`number`, required, nullable, at least -1000000000000, at most 1000000000000)
  - `max` (`number`, required, nullable, at least -1000000000000, at most 1000000000000)
- `copy` (`object`, required)
  - `title` (`string`, required, up to 200 characters)
  - `description` (`string`, required, nullable, up to 2000 characters)
  - `submitLabel` (`string`, required, 1 to 60 characters)
  - `successTitle` (`string`, required, up to 200 characters)
  - `successMessage` (`string`, required, up to 2000 characters)
  - `pendingTitle` (`string`, required, up to 200 characters)
  - `pendingMessage` (`string`, required, up to 2000 characters)
  - `closedTitle` (`string`, required, up to 200 characters)
  - `closedMessage` (`string`, required, up to 2000 characters)
  - `footer` (`string`, required, nullable, up to 2000 characters)
- `style` (`object`, required)
  - `accent` (`string`, required, pattern `^#[0-9a-fA-F]{6}$`)
  - `background` (`string`, required, pattern `^#[0-9a-fA-F]{6}$`)
  - `surface` (`string`, required, pattern `^#[0-9a-fA-F]{6}$`)
  - `text` (`string`, required, pattern `^#[0-9a-fA-F]{6}$`)
  - `font` (`string`, required, one of `"system"`, `"sans"`, `"serif"`, `"mono"`)
  - `radius` (`string`, required, one of `"none"`, `"sm"`, `"md"`, `"lg"`, `"full"`)
  - `width` (`string`, required, one of `"narrow"`, `"normal"`, `"wide"`)
  - `layout` (`string`, required, one of `"card"`, `"plain"`)
  - `align` (`string`, required, one of `"left"`, `"center"`)
  - `logoUrl` (`string`, required, nullable, up to 2000 characters, format `uri`)

#### `ShareLink`

`object`

- `object` (`string`, required, one of `"share_link"`)
- `id` (`string`, required)
- `kind` (`string`, required, one of `"template"`, `"form"`, `"automation"`)
- `itemId` (`string`, required): The template, form or automation the link shows.
- `itemName` (`string`, required): Its name, as it is now.
- `token` (`string`, required): The secret part of the link. `GET /shared/{token}` and `POST /shared/{token}/copy` take it.
- `url` (`string`, required, format `uri`): The public page anyone with the link can open, without an account.
- `copyable` (`boolean`, required): True when people may copy the item into their own workspace from the page, false when they may only look at it.
- `views` (`integer`, required, at least 0): How often the public page was opened.
- `copies` (`integer`, required, at least 0): How often the item was copied into a workspace from the link.
- `lastViewedAt` (`string`, required, nullable, format `date-time`)
- `lastCopiedAt` (`string`, required, nullable, format `date-time`)
- `createdAt` (`string`, required, format `date-time`): When the item was made public at this link.
- `updatedAt` (`string`, required, format `date-time`)

#### `ShareLinkList`

`object`

- `object` (`string`, one of `"list"`)
- `data` (`ShareLink[]`)
- `hasMore` (`boolean`): True when another page follows. Pass `nextCursor` back as `cursor` to read it.
- `nextCursor` (`string`, nullable): The id of the last row on this page, or null on the last page.

#### `SharedAutomation`

`object`

- `definition` (`AutomationDefinition`, required)
- `templates` (`SharedAutomationTemplate[]`, required): The template each send step sends, by the step it belongs to.
- `settings` (`AutomationSettings`, required)

#### `SharedAutomationTemplate`

`object`

- `stepKey` (`string`, required): The send step that sends it.
- `name` (`string`, required)
- `subject` (`string`, required)

#### `SharedCopy`

`object`

- `object` (`string`, required, one of `"shared_copy"`)
- `kind` (`string`, required, one of `"template"`, `"form"`, `"automation"`)
- `id` (`string`, required): The new template, form or automation, a draft here.
- `name` (`string`, required)
- `templateIds` (`string[]`, required): The templates copied along with an automation, empty for the rest.

#### `SharedForm`

`object`

- `document` (`FormDocument`, required)
- `doubleOptIn` (`boolean`, required): True when the form asks people to confirm their address before they join.

#### `SharedItem`

`object`

- `object` (`string`, required, one of `"shared_item"`)
- `kind` (`string`, required, one of `"template"`, `"form"`, `"automation"`)
- `token` (`string`, required)
- `name` (`string`, required)
- `description` (`string`, required, nullable)
- `workspaceName` (`string`, required): The workspace that shares it, empty when it has no name.
- `copyable` (`boolean`, required)
- `sharedAt` (`string`, required, format `date-time`)
- `template` (`SharedTemplate`, required)
- `form` (`SharedForm`, required)
- `automation` (`SharedAutomation`, required)

#### `SharedTemplate`

`object`

- `subject` (`string`, required): The subject, with the sample values filled in.
- `engine` (`string`, required, one of `"blocks"`, `"html"`)
- `slots` (`TemplateSlot[]`, required)
- `props` (`TemplateProp[]`, required)
- `html` (`string`, required): The email rendered with the sample values.
- `text` (`string`, required): The plain text part, rendered the same way.
- `unfilled` (`string[]`, required): The props and slots that have no sample value, so they render empty.

#### `TemplateProp`

`object`

- `key` (`string`): A letter followed by letters, digits or underscores. This is what `{{key}}` in the subject or the body refers to, and what a send names in `props` or `slots`.
- `label` (`string`): For whoever fills it in. Never rendered into the message.
- `kind` (`string`, one of `"text"`, `"url"`, `"image"`): How a supplied value is escaped when it lands in the body. `text` becomes a React child, so React escapes it; `url` and `image` are parsed and scheme-checked before they reach an `href` or a `src`. The kind is declared rather than sniffed from the value, because a string that happens to start with `https:` is not evidence that the author meant it to be followed.
- `required` (`boolean`): A required prop missing at send is a 422 and no mail leaves. That refusal is the most valuable rule in the feature: the alternative is a message going out with a blank where the order number should be, which nothing reports, nobody notices, and no one can recall.
- `default` (`string`, nullable): Used when the caller names nothing. Null means there is no fallback: either the prop is required and its absence is refused, or it renders empty.

#### `TemplateSlot`

`object`

- `key` (`string`): A letter followed by letters, digits or underscores. This is what `{{key}}` in the subject or the body refers to, and what a send names in `props` or `slots`.
- `label` (`string`): For whoever fills it in. Never rendered into the message.
- `kind` (`string`, one of `"text"`, `"url"`, `"image"`): How a supplied value is escaped when it lands in the body. `text` becomes a React child, so React escapes it; `url` and `image` are parsed and scheme-checked before they reach an `href` or a `src`. The kind is declared rather than sniffed from the value, because a string that happens to start with `https:` is not evidence that the author meant it to be followed.
- `default` (`string`): What renders when nobody overrides it. Never null. A slot always has something to fall back to, which is the difference between it and a prop.