> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Take a batch of a shared session's entries > The INWARD half of publishing, served by the organisation's home and called by a developer's. It takes redacted entries for one share and is the only way anything of a shared session arrives here. IT IS THIS CONTRACT AND NOT A SECOND PROTOCOL. The organisation's home is a narya host, so a publish is an operation on the contract this product already serves, authenticated by the same bearer on the same terms as every other. A caller reaches it with the publishing person's own token: the owner recorded here is that verified actor and never a field in this body. IDEMPOTENT PER ENTRY ID. A sending home cannot tell a delivery whose answer was lost from one that never happened, so it re-offers everything it has not seen acknowledged; an entry id this share already holds is taken as already held rather than written twice. A retry after a partial failure therefore completes rather than duplicating, and it may safely re-send the whole batch. THE FIRST DELIVERY IS WHAT ANNOUNCES THE SHARE. There is no earlier registration and deliberately no second operation for one, which is why the body carries the session the entries came from and the mode the publish is in alongside them. A REVOKED SHARE IS 410 NRY-0031, TERMINALLY. Its entries were deleted at somebody's request and the row survives only as a tombstone, so work queued before the revocation and offered after it is refused rather than accepted — a delivery that succeeded here would undo a deletion. The refusal is answered identically forever and a caller drops the work rather than retrying it. The redaction happened at the home the entries came from, which is the only place a *before* exists. Nothing here can widen what was sent, and nothing here is asked to. ## OpenAPI ````yaml /pt/openapi/v3-current/narya.yaml post /v1/shares/{shareId}/entries openapi: 3.1.0 info: title: Narya Host API version: 1.0.0 description: >- The contract between the Narya host and every client. One long-lived host serves this API over a Unix socket in your Narya home. The terminal client and the one-shot command that Lerian ships drive this API, and a client you write drives the same one. Requests authenticate with a bearer token issued by the identity provider the host is configured with. An operation that declares another security scheme also accepts that credential. A request without a valid credential gets 401 with NRY-0011. A caller whose role lacks the permission an operation needs gets 403 with NRY-0028. Submitting a message returns 202 with a turn id. Everything the turn produces streams over GET /v1/events as server-sent events with a typed envelope, and a stream resumes from a Last-Event-ID header. One error envelope: code, title and message. Codes are NRY- followed by four digits. Cursors are opaque. servers: [] security: - bearerAuth: [] tags: - name: host description: The host process itself — version, uptime, mode, store. - name: sessions description: Durable conversation containers. Archive, never destroy. - name: messages description: Submitting work into a session and interrupting it. - name: events description: The server-sent event stream every client consumes. - name: lanes description: Parallel tracks inside a session — main, subagent, side. - name: agents description: Named recipes — instructions, tools, model, policy. Read-only in v1. - name: ladder description: >- What a person can type: the skills and command files in force for one repository, and expanding one into text. Five origins merged, nearest winning a name, the repository's own rungs gated on trust. - name: permissions description: Pending permission asks, decisions, and the decision audit. - name: intercom description: Sessions on one machine finding and messaging each other. - name: packages description: The one thing a user installs — resources, Go code, or both. - name: extensions description: >- Host-side extensions and the operations each exposes over the wire. This is the generic lane a host extension uses to serve its own client half (a TUI component, a web panel) or any API-only consumer, without adding routes to this contract. - name: workflows description: Deterministic multi-agent orchestration runs. - name: providers description: Model suppliers, their auth state, and the model catalogue. - name: monitors description: >- Long-running watchers a session keeps beside its conversation — a test runner in watch mode, a build, a log being followed. Started by the model or by the person, always listed, always killable. - name: records description: The queryable local record of everything that happened. - name: environments description: >- Where a session's code lives and its commands run — this machine, or a container narya operates. A session that names none runs here. - name: schedules description: >- Work the host's own clock starts with nobody present — a repository, a prompt, a rule and what one fire may spend. Cancel, never destroy. - name: sharing description: >- Publishing a session from a developer's own home to the organisation's, and what is held back before a byte leaves the machine. - name: refinements description: >- What this owner has taught narya and allowed it to keep — distilled facts, and the skills, agents and commands the model wrote for itself. Propose, read, consent, roll back. Nothing here fires until a person answers. - name: platform description: >- Calls Lerian's control plane made to a home it hosts, as this home recorded them. paths: /v1/shares/{shareId}/entries: parameters: - $ref: '#/components/parameters/ShareIdParam' post: tags: - sharing summary: Take a batch of a shared session's entries description: >- The INWARD half of publishing, served by the organisation's home and called by a developer's. It takes redacted entries for one share and is the only way anything of a shared session arrives here. IT IS THIS CONTRACT AND NOT A SECOND PROTOCOL. The organisation's home is a narya host, so a publish is an operation on the contract this product already serves, authenticated by the same bearer on the same terms as every other. A caller reaches it with the publishing person's own token: the owner recorded here is that verified actor and never a field in this body. IDEMPOTENT PER ENTRY ID. A sending home cannot tell a delivery whose answer was lost from one that never happened, so it re-offers everything it has not seen acknowledged; an entry id this share already holds is taken as already held rather than written twice. A retry after a partial failure therefore completes rather than duplicating, and it may safely re-send the whole batch. THE FIRST DELIVERY IS WHAT ANNOUNCES THE SHARE. There is no earlier registration and deliberately no second operation for one, which is why the body carries the session the entries came from and the mode the publish is in alongside them. A REVOKED SHARE IS 410 NRY-0031, TERMINALLY. Its entries were deleted at somebody's request and the row survives only as a tombstone, so work queued before the revocation and offered after it is refused rather than accepted — a delivery that succeeded here would undo a deletion. The refusal is answered identically forever and a caller drops the work rather than retrying it. The redaction happened at the home the entries came from, which is the only place a *before* exists. Nothing here can widen what was sent, and nothing here is asked to. operationId: receiveShareEntries requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ShareDelivery' responses: '204': description: >- Every entry in the batch is now held for this share — including any this home already had, which is what makes a retry safe. '400': $ref: '#/components/responses/BadRequest' '403': $ref: '#/components/responses/Forbidden' '410': description: >- The share has been revoked at this home (NRY-0031). Terminal: the refusal never changes, and the caller drops the work rather than retrying it. content: application/json: schema: $ref: '#/components/schemas/Error' '413': $ref: '#/components/responses/RequestBodyTooLarge' '422': $ref: '#/components/responses/UnprocessableEntity' '500': $ref: '#/components/responses/InternalServerError' components: parameters: ShareIdParam: name: shareId in: path required: true description: >- The share's id, as `SessionShare.shareId` reports it: 26 characters of RFC 4648 base32 drawn from a cryptographic source, carrying no encoding of anything. It is NOT a uuid and is deliberately unrelated to the session id it was published from — a share id travels, so an id derived from a session would make every leaked link a statement about the machine it came from. schema: type: string minLength: 26 maxLength: 26 pattern: ^[A-Z2-7]{26}$ schemas: ShareDelivery: type: object description: >- One batch of a shared session crossing to the organisation's home. It carries the share's own facts alongside the entries because the first delivery is what announces the share at the receiving end — there is no earlier registration and no second operation for one. What it does NOT carry is who owns the share or which organisation it belongs to: the owner is the verified actor whose token carried the request, and the organisation is the home that took it. required: - sessionId - mode - entries properties: sessionId: type: string format: uuid description: >- The session these entries came from, at the home they came from. Provenance only — no session with this id exists at the receiving end, and none is created. mode: type: string enum: - once - sync description: >- Where the publish stops, so the receiving home's record is honest about whether more is coming. entries: type: array description: >- The entries of this batch, in the order the conversation happened in. One batch carries everything a drain found owed rather than one entry per request: a chatty session must not become a request per token. items: $ref: '#/components/schemas/ShareDeliveryEntry' expiresAt: type: string format: date-time description: >- When this share stops, carried so the receiving home stops it by its OWN clock. The sweep that deletes these entries runs there, so a copy that arrived without this would be a conversation whose expiry depended on the publishing machine being switched on. Absent means a share with no expiry, which nothing this product publishes produces. recipients: type: array items: type: string description: >- Who this share is for, as the publishing home holds it: the subjects of the colleagues it names, or ABSENT for the whole organisation — one spelling of "everybody here", matching the publishing home's own record. IT HAS TO TRAVEL, because the READ road is at this end. A copy that arrived without the list would be readable by every member of the organisation however narrowly the person who shared it chose, which is the one direction a targeted share must not be wrong in. It is read on the FIRST delivery, which is what announces the share here; a later batch does not re-open who a share this home already holds is for. examples: - sessionId: 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d mode: sync entries: - id: 3f1c9a52-8d4e-4b21-9c07-5e2a1d8b6f40 kind: user-message sequence: 1 text: 'deploy with ANTHROPIC_API_KEY=[redacted: masked-environment]' Error: type: object description: >- The single error envelope every operation returns. Codes are NRY- followed by four digits and are catalogued in the top-level x-error-catalog extension. required: - code - title - message properties: code: type: string pattern: ^NRY-[0-9]{4}$ description: Machine-readable error code from the NRY catalogue. title: type: string maxLength: 256 description: Short human-readable summary of the error class. message: type: string maxLength: 4096 description: Specific, actionable description of what went wrong. fields: type: object description: Per-field validation problems. additionalProperties: type: string examples: - code: NRY-0002 title: Session not found message: >- No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host. ShareDeliveryEntry: type: object description: >- One entry as it crosses: already redacted, still in its place. It is the same four facts SessionSharePreviewEntry reports, because it is the same computation — what a person was shown before the bytes left is what the bytes are. required: - id - kind - sequence properties: id: type: string format: uuid description: >- The entry's own id at the home it was published from. It is what makes a delivery idempotent: the receiving home recognises a retry by it, which is the one thing the sending home cannot do for itself when an answer is lost. kind: type: string enum: - user-message - assistant-message - tool-call - tool-result - summary - system - intercom - monitor-event description: The transcript row's kind, unchanged by redaction. sequence: type: integer format: int64 minimum: 1 description: >- The entry's place in the transcript at the publishing home. Carried rather than re-derived: entries arrive in batches a drain decided the shape of, so arrival order is the drain's history and not the conversation's. text: type: string description: >- What is being sent for this entry, with every rule already applied. Absent for an entry that carries nothing this surface publishes — such an entry still crosses, so the sequence a reader follows stays honest. responses: BadRequest: description: Malformed request — invalid parameter, cursor, or JSON body. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: >- The caller is authenticated and is not allowed this operation (NRY-0028 or NRY-0030). content: application/json: schema: $ref: '#/components/schemas/Error' RequestBodyTooLarge: description: >- The request body weighs more than this operation accepts (NRY-0024). The host holds one ceiling per operation and refuses at the door, in front of every handler: a body whose declared Content-Length is past the ceiling is refused before a byte of it is read, and a body that declares no length is read only as far as the ceiling and refused there. Nothing was read past that point and nothing was written. content: application/json: schema: $ref: '#/components/schemas/Error' UnprocessableEntity: description: The request was well-formed but failed validation. content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: The host failed — including a store that refuses writes (NRY-0012). content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Enforced on every transport, with no exempt operation. A person's request — over the default local unix socket exactly as over a TCP listener — must carry a JWT issued by the configured identity provider, which the host verifies itself against that issuer's key set: signature, issuer, expiry, and the person and organisation it names. Requests without a valid one receive 401 NRY-0011. The socket's file permissions are transport and are not an authorisation. ````