> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Publish this session to the organisation's home > Copies this session, already redacted, to the organisation's home, where the team reads it. The developer's home is where the work happens and the organisation's is where it is read, so this is a one-way copy addressed by a share id and never a synchronisation of two equal stores. Read `GET /v1/sessions/{sessionId}/share/preview` first and show a person the document: it is the last moment before the bytes leave their machine. THE MODE IS WHERE THE PUBLISH STOPS, and there are two. `once` copies the entries that exist and is finished. `sync` leaves the share subscribed, so entries said afterwards ride the same queue — one road with two stopping rules rather than a streaming mechanism beside a batch one. THE SHARE ID IS DRAWN AND CARRIES NOTHING. It is unrelated to the session id by construction, so a share link that leaks says nothing about the machine it came from. Publishing the same session twice creates a second share with its own id; a revoked share is never resumed, and re-sharing after a revocation is always a new one. AN UNREACHABLE ORGANISATION'S HOME IS 503 NRY-0029 AND IS NOT A FAILURE. The share is recorded and every entry is owed on disk before anything is sent, so an unreachable organisation's home means the work is queued: a later drain carries it, complete and in order, and the message names the share. Nothing about local work is blocked by it. ## OpenAPI ````yaml /es/openapi/v3-current/narya.yaml post /v1/sessions/{sessionId}/share openapi: 3.1.0 info: title: Narya Host API version: 1.0.0 description: >- The contract between the Narya host and every client. One long-lived host serves this API over a Unix socket in your Narya home. The terminal client and the one-shot command that Lerian ships drive this API, and a client you write drives the same one. Requests authenticate with a bearer token issued by the identity provider the host is configured with. An operation that declares another security scheme also accepts that credential. A request without a valid credential gets 401 with NRY-0011. A caller whose role lacks the permission an operation needs gets 403 with NRY-0028. Submitting a message returns 202 with a turn id. Everything the turn produces streams over GET /v1/events as server-sent events with a typed envelope, and a stream resumes from a Last-Event-ID header. One error envelope: code, title and message. Codes are NRY- followed by four digits. Cursors are opaque. servers: [] security: - bearerAuth: [] tags: - name: host description: The host process itself — version, uptime, mode, store. - name: sessions description: Durable conversation containers. Archive, never destroy. - name: messages description: Submitting work into a session and interrupting it. - name: events description: The server-sent event stream every client consumes. - name: lanes description: Parallel tracks inside a session — main, subagent, side. - name: agents description: Named recipes — instructions, tools, model, policy. Read-only in v1. - name: ladder description: >- What a person can type: the skills and command files in force for one repository, and expanding one into text. Five origins merged, nearest winning a name, the repository's own rungs gated on trust. - name: permissions description: Pending permission asks, decisions, and the decision audit. - name: intercom description: Sessions on one machine finding and messaging each other. - name: packages description: The one thing a user installs — resources, Go code, or both. - name: extensions description: >- Host-side extensions and the operations each exposes over the wire. This is the generic lane a host extension uses to serve its own client half (a TUI component, a web panel) or any API-only consumer, without adding routes to this contract. - name: workflows description: Deterministic multi-agent orchestration runs. - name: providers description: Model suppliers, their auth state, and the model catalogue. - name: monitors description: >- Long-running watchers a session keeps beside its conversation — a test runner in watch mode, a build, a log being followed. Started by the model or by the person, always listed, always killable. - name: records description: The queryable local record of everything that happened. - name: environments description: >- Where a session's code lives and its commands run — this machine, or a container narya operates. A session that names none runs here. - name: schedules description: >- Work the host's own clock starts with nobody present — a repository, a prompt, a rule and what one fire may spend. Cancel, never destroy. - name: sharing description: >- Publishing a session from a developer's own home to the organisation's, and what is held back before a byte leaves the machine. - name: refinements description: >- What this owner has taught narya and allowed it to keep — distilled facts, and the skills, agents and commands the model wrote for itself. Propose, read, consent, roll back. Nothing here fires until a person answers. - name: platform description: >- Calls Lerian's control plane made to a home it hosts, as this home recorded them. paths: /v1/sessions/{sessionId}/share: parameters: - $ref: '#/components/parameters/SessionIdParam' post: tags: - sharing summary: Publish this session to the organisation's home description: >- Copies this session, already redacted, to the organisation's home, where the team reads it. The developer's home is where the work happens and the organisation's is where it is read, so this is a one-way copy addressed by a share id and never a synchronisation of two equal stores. Read `GET /v1/sessions/{sessionId}/share/preview` first and show a person the document: it is the last moment before the bytes leave their machine. THE MODE IS WHERE THE PUBLISH STOPS, and there are two. `once` copies the entries that exist and is finished. `sync` leaves the share subscribed, so entries said afterwards ride the same queue — one road with two stopping rules rather than a streaming mechanism beside a batch one. THE SHARE ID IS DRAWN AND CARRIES NOTHING. It is unrelated to the session id by construction, so a share link that leaks says nothing about the machine it came from. Publishing the same session twice creates a second share with its own id; a revoked share is never resumed, and re-sharing after a revocation is always a new one. AN UNREACHABLE ORGANISATION'S HOME IS 503 NRY-0029 AND IS NOT A FAILURE. The share is recorded and every entry is owed on disk before anything is sent, so an unreachable organisation's home means the work is queued: a later drain carries it, complete and in order, and the message names the share. Nothing about local work is blocked by it. operationId: publishSession requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SessionSharePublish' responses: '201': description: The share this publish created. content: application/json: schema: $ref: '#/components/schemas/SessionShare' '400': $ref: '#/components/responses/BadRequest' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '413': $ref: '#/components/responses/RequestBodyTooLarge' '422': $ref: '#/components/responses/UnprocessableEntity' '500': $ref: '#/components/responses/InternalServerError' '503': description: >- The share was recorded and its entries are queued; the organisation's home did not answer (NRY-0029). A statement about delivery rather than about the request — the message names the share, and a later drain carries the work. content: application/json: schema: $ref: '#/components/schemas/Error' components: parameters: SessionIdParam: name: sessionId in: path required: true description: The session's id. schema: type: string format: uuid schemas: SessionSharePublish: type: object description: >- One person asking for one session to be published to the organisation's home. THERE IS NO ORGANISATION FIELD AND NO OWNER FIELD, and their absence is the design rather than an omission. One organisation is one home, so which organisation this is arrives with the token and the home refuses a token for any other before a handler runs; and the person publishing is the verified actor, so an owner a caller could name would be an owner a caller could get wrong. required: - mode properties: mode: type: string enum: - once - sync description: >- Where this publish stops. `once` copies the entries that exist and is finished. `sync` leaves the share subscribed, so entries said afterwards ride the same queue to the same place. There is no third value, because the difference between these two is a stopping rule and not a mechanism. expiresAt: type: string format: date-time description: >- When this share stops. Absent takes the host's configured window, which is the point rather than a convenience: a share nobody thought about still stops, so there is no way to ask for one that never does. An instant already past is refused rather than accepted, because a person told their session is shared, whose copy is deleted a moment later, has been told something false. recipients: type: array items: type: string description: >- The colleagues this share is for, each named by the subject their sign-in reports. ABSENT OR EMPTY IS THE WHOLE ORGANISATION, and that is the default rather than a special case: a person publishing to their team names nobody, and narrowing is what somebody has to ask for. Naming colleagues is also what makes a session its owner marked PRIVATE readable — by them, bounded to the entries the share has actually delivered. A value no sign-in could ever report — a blank, an address with a space in it, a pasted line — is refused by name, since a share written for a mistyped colleague is a share readable by nobody with a 201 in front of it. Whether a well-formed subject belongs to this organisation is not checked here: that is a directory call this home cannot make, and a grant it cannot exercise anyway. examples: - mode: once - mode: sync - mode: sync expiresAt: '2026-10-08T09:15:00.000Z' - mode: sync recipients: - user_grace - user_auditor SessionShare: type: object description: >- One session published to the organisation's home, as this home records it. required: - shareId - sessionId - mode - state - createdAt properties: shareId: type: string description: >- The share's id, which addresses it everywhere outside this home — a URL, the organisation's home, whatever a colleague pastes into a chat. Drawn from a cryptographic source and unrelated to sessionId by construction, so it discloses nothing about the session or the machine it came from. minLength: 26 maxLength: 26 pattern: ^[A-Z2-7]{26}$ sessionId: type: string format: uuid description: >- The session in THIS home that was published. It is provenance: at the organisation's home the same share is addressed by shareId and that session does not exist there. mode: type: string enum: - once - sync description: Where this publish stops. state: type: string enum: - pending - active - revoked description: >- How far it has got. `pending` is a share whose first entry has not reached the organisation's home — which is what a 503 NRY-0029 leaves behind. `active` is a share the organisation's home holds: complete for `once`, still following for `sync`. `revoked` is terminal. Whether a share has EXPIRED is deliberately not a state here: that is a comparison against a clock, and a stored copy of it would go stale on its own. createdAt: type: string format: date-time description: When the person asked for it. expiresAt: type: string format: date-time readOnly: true description: >- When this share stops: the instant the publish named, or the host's configured window from when it was asked for. It is the host's answer and never a client's calculation. A share whose expiry has passed is closed whether or not the sweep that deletes it has run yet — which is why `state` carries no `expired` value. Once the sweep HAS run, the copied entries are deleted and the state reads `revoked`, because that is what happened to it. recipients: type: array readOnly: true items: type: string description: >- Who this share is for, as the host now holds it: the subjects named on it, or ABSENT for the whole organisation. It is the host's record and never a client's copy of what it asked for. examples: - shareId: K7QX2ZM4YB6PWNRJ5TFHCDA3EV sessionId: 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d mode: sync state: active createdAt: '2026-09-08T09:15:00.000Z' expiresAt: '2026-10-08T09:15:00.000Z' recipients: - user_grace - user_auditor Error: type: object description: >- The single error envelope every operation returns. Codes are NRY- followed by four digits and are catalogued in the top-level x-error-catalog extension. required: - code - title - message properties: code: type: string pattern: ^NRY-[0-9]{4}$ description: Machine-readable error code from the NRY catalogue. title: type: string maxLength: 256 description: Short human-readable summary of the error class. message: type: string maxLength: 4096 description: Specific, actionable description of what went wrong. fields: type: object description: Per-field validation problems. additionalProperties: type: string examples: - code: NRY-0002 title: Session not found message: >- No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host. responses: BadRequest: description: Malformed request — invalid parameter, cursor, or JSON body. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: >- The caller is authenticated and is not allowed this operation (NRY-0028 or NRY-0030). content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: The addressed resource does not exist on this host. content: application/json: schema: $ref: '#/components/schemas/Error' RequestBodyTooLarge: description: >- The request body weighs more than this operation accepts (NRY-0024). The host holds one ceiling per operation and refuses at the door, in front of every handler: a body whose declared Content-Length is past the ceiling is refused before a byte of it is read, and a body that declares no length is read only as far as the ceiling and refused there. Nothing was read past that point and nothing was written. content: application/json: schema: $ref: '#/components/schemas/Error' UnprocessableEntity: description: The request was well-formed but failed validation. content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: The host failed — including a store that refuses writes (NRY-0012). content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Enforced on every transport, with no exempt operation. A person's request — over the default local unix socket exactly as over a TCP listener — must carry a JWT issued by the configured identity provider, which the host verifies itself against that issuer's key set: signature, issuer, expiry, and the person and organisation it names. Requests without a valid one receive 401 NRY-0011. The socket's file permissions are transport and are not an authorisation. ````