Share

Request body

action: "list" — list authorized emails

// Request
{ "token": "OWNER_TOKEN", "action": "list" }

// Response
{ "success": true, "authorized_emails": ["collaborator@email.com", "team2@email.com"] }

action: "grant" — authorize an email

// Request
{ "token": "OWNER_TOKEN", "action": "grant", "email": "collaborator@email.com" }

// Response
{ "success": true }

Granting access to an already-authorized email is idempotent — no duplicate is created. The email only becomes usable once the collaborator has their own Vanelton ID account registered with that exact address; it's the authenticated collaborator's account email (via their own token) that gets checked when they pass owner_userid on another endpoint.

action: "revoke" — remove authorization

// Request
{ "token": "OWNER_TOKEN", "action": "revoke", "email": "collaborator@email.com" }

// Response
{ "success": true }

Revoking an email that wasn't authorized also returns success. Access is cut immediately on the collaborator's next call — there's no caching.

How a collaborator uses granted access

Once authorized, the collaborator calls get.php, set.php, delete.php, or merge.php normally, authenticated with their own token, adding owner_userid with the owner's numeric ID:

{
  "token": "COLLABORATOR_TOKEN",
  "owner_userid": 123,
  "cloudkey": "shared-inventory",
  "dataobject": { "items": 42 }
}

Errors