Create
Make a link. access.domains off the workspace’s allow-list are
refused with 422 domain_not_allowed, and editorUserIds naming
anybody who is not a member of the workspace with
422 validation_error. Any member with a seat may, with a signed-in
session as in the app, except a Viewer of Go Links (403 viewer_only).
Authentication
Bearer authentication of the form Bearer <token>, where token is your auth token.
Request
A bare acme.com/thing is assumed to be https. Anything that is not
http(s) is refused: a javascript: destination on a link the whole
company is told to click is stored XSS.
Who may change it, beside its creator and Go Links’ app admins;
empty or left out, anybody with a seat who is not a Viewer of Go
Links. Each must be a member of the workspace, with a key as with a session:
anybody else (a user of another workspace, or an id that is
nobody’s) is a 422 validation_error with
details: { field: "editorUserIds", userIds } naming them, and
nothing is saved.
Response
The bit after go/. Normalised hard on the way in: lowercase, with
spaces and underscores folded to hyphens, because the whole value
of go/roadmap is that a colleague can guess it.
The address to hand out: on the workspace’s own Go Links hostname
where it has one (https://go.acme.com/roadmap), otherwise this
installation’s /go/roadmap, which asks a member to sign in. What
the link’s QR code (qrCode) holds: the short link, never the
destination, so re-pointing the link breaks nothing printed.
Who may change it, when it is not simply anybody with a seat, beside
its creator and Go Links’ app admins, who always may. Empty means no
restriction, which is what every link is until somebody narrows it.
A Viewer of Go Links changes no link, named or not. Never affects who may follow a link: that is access.
Members of the workspace when they were named; somebody since
removed from it stays listed until the link’s editors are saved
again.
Who may follow this link on the Go Links hostname, as a Dory event’s
audience says who may join it. There is no “anyone signed in”: anybody
can make an account, so for links it would be no check at all. A link
made without saying is DOMAIN with no domains listed.
Where it goes. Null for a draft when called with a signed-in session by somebody who may not edit the link: a draft’s destination is its editors’ business. A key always sees it.