> ## Documentation Index > Fetch the complete documentation index at: https://developers.conveyour.com/llms.txt > Use this file to discover all available pages before exploring further. # Get a shared report > Returns a shared report without requiring authentication. Access is granted by the `pid` (a capability URL). For secure shared reports, pass a `token` query parameter containing the JWT generated by `POST /api/custom-reports/:id/share`. Shared reports have actions stripped and locked controls hidden — only the data and editable controls are returned. The `report_id` segment is optional — `/api/reports/shared/{pid}` returns the shared report directly, and `/api/reports/shared/{pid}/{report_id}` selects a specific report within a shared bundle. Get a shared report (no auth required) This endpoint requires **no authentication**. Anyone who has the shared-report `pid` can read the report. **A missing record does not return 404.** This handler reports the failure without a status code, and the error envelope defaults to HTTP `200` — you get `200` with `status: "failed"`. Branch on `status`, not on the HTTP code. ## OpenAPI ````yaml /api-reference/specs/reports.json get /api/reports/shared/{pid} openapi: 3.1.0 info: title: ConveYour API — Reports description: >- Retrieve report data, run report actions, access shared reports, and manage custom report templates. version: 1.0.0 servers: - url: https://{subdomain}.conveyour.com description: Your organization's ConveYour instance variables: subdomain: default: acme description: >- Your organization's slug — the subdomain you sign in on. Replace `acme` with yours: if you sign in at `bigco.conveyour.com`, enter `bigco`. security: - conveyourToken: [] tags: - name: Reports description: >- Retrieve report data, run report actions, access shared reports, and manage custom report templates. paths: /api/reports/shared/{pid}: get: tags: - Reports summary: Get a shared report description: >- Returns a shared report without requiring authentication. Access is granted by the `pid` (a capability URL). For secure shared reports, pass a `token` query parameter containing the JWT generated by `POST /api/custom-reports/:id/share`. Shared reports have actions stripped and locked controls hidden — only the data and editable controls are returned. The `report_id` segment is optional — `/api/reports/shared/{pid}` returns the shared report directly, and `/api/reports/shared/{pid}/{report_id}` selects a specific report within a shared bundle. Get a shared report (no auth required) This endpoint requires **no authentication**. Anyone who has the shared-report `pid` can read the report. **A missing record does not return 404.** This handler reports the failure without a status code, and the error envelope defaults to HTTP `200` — you get `200` with `status: "failed"`. Branch on `status`, not on the HTTP code. operationId: getASharedReportNoAuthRequired parameters: - name: pid in: path required: true description: The pid identifier. schema: type: string - name: token in: query description: >- JWT token encoding the locked parameter values. Required when the shared report is configured with `secure=true`. schema: type: string - name: data in: query description: Pass `data=1` to include report rows in the response. schema: type: integer - $ref: '#/components/parameters/teams' - name: cyx_provider in: query required: false description: Override the reports provider used to resolve the shared report. schema: type: string responses: '200': description: Success. content: application/json: schema: allOf: - $ref: '#/components/schemas/Envelope' - type: object properties: data: $ref: '#/components/schemas/ReportConfig' '403': $ref: '#/components/responses/ForbiddenToken' security: [] components: parameters: teams: name: teams[] in: query description: >- Team scope for the request, as one or more team ObjectIds. The brackets are required: PHP keeps only the last value for a repeated plain key, so `teams=A&teams=B` silently resolves to B alone. On requests with a JSON body you may send `teams` (no brackets) in the body instead. **Values that are not valid ObjectIds are silently ignored** — a mistyped team ID behaves as if no team was sent. See the [teams section of the API conventions guide](/guides/api-conventions#team-scoping). style: form explode: true schema: type: array items: type: string example: - 64a1b2c3d4e5f6a7b8c9d0ff schemas: Envelope: type: object description: The common response envelope shared by all ConveYour endpoints. properties: status: type: string enum: - ok - failed description: '`ok` on success, `failed` on error.' message: type: string description: Human-readable description of the result. data: description: >- The response payload — an object or an array depending on the endpoint. ReportConfig: type: object description: A generated report configuration — NOT a saved custom report record. properties: id: type: string description: >- The registered report ID, e.g. contactsList. Set by getReportConfig(). title: type: string description: >- Report title. On a shared report this is overridden by the saved report title. desc: type: string description: Static description declared on the report class. folder: type: string description: Static folder the report is grouped under. parent: type: string description: >- Parent report ID. Reports with a parent are omitted from the list endpoint. visual: type: string description: Visual renderer key. fields: type: object description: Column definitions, keyed by field key. additionalProperties: type: object properties: title: type: string description: Column heading. Defaults to the title-cased key. type: type: string description: Mapped schema field type. is: type: string description: Optional role hint; present only when passed to addField(). description: >- Remaining keys come from the per-report schema passed to addField() and vary by report. controls: type: object description: >- Control definitions, keyed by control key. Present only when the report registers controls. child_reports: type: array items: type: object description: Nested reports. Present only when the report registers them. actions: type: object description: >- Registered row actions, keyed by action key. On a shared report this is filtered to shared-safe actions, or removed entirely. additionalProperties: $ref: '#/components/schemas/ReportAction' row_key: type: string description: The field identifying a row, used by the action endpoints. exportable: type: boolean description: Whether the report supports CSV export. shareable: type: boolean description: Whether the report can be shared. params: type: object description: Resolved query parameters. Returned only when params=true. data: type: object description: >- The report rows. Returned only when data=true (or format=csv). Shape varies by report. retrieved_at: type: integer description: Unix timestamp of the data fetch. Present only alongside data. visual_props: type: object description: Renderer hints for the returned data. Present only alongside data. debug: type: object description: Debug payload. Present outside production, or when debug is passed. ReportAction: type: object description: One registered row action. properties: label: type: string description: Button label. Defaults to the title-cased action key. confirm: type: boolean description: Whether the UI confirms before running. Defaults to false. confirm_text: type: string description: Confirmation prompt text. destructive: type: boolean description: Marks the action as destructive. Defaults to false. client: type: boolean description: Whether the action runs client-side. Defaults to false. handler: type: string description: Client handler name, when client is true. responses: ForbiddenToken: description: >- The token is missing, expired, or not permitted for this HTTP method. **This endpoint enforces no named permission**, so a 403 here never carries a `permission` field. content: application/json: example: status: failed message: Token is either expired or does not have the correct permissions data: [] securitySchemes: conveyourToken: type: apiKey in: header name: x-conveyour-token description: >- Your API key token. Contacts endpoints require a **Server-only — Full API** key — see [Authentication](/quickstart). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.