Public link to a file

POST /v1/files/:id/public-link

Anyone can access the file without signing in. You cannot disable the link through the API: use the Bitrix24 interface or permanently delete the object.

The method creates a link if none exists. Repeated calls return the same link. An existing link from another employee may be returned, possibly with a password or expiry. The response does not tell you whether it is protected. Never write the URL to logs, audit records or telemetry. Trash only suspends access; restoring the object opens the existing link again. A trashed object is allowed and returns meta.inTrash=true; the link shows an object-not-found page until restoration.

Parameters

Parameter	Type	Required	Description
id	integer	yes	Positive safe integer

Key scope: disk. No body required. READONLY keys cannot publish.

curl — personal key

Terminal

curl -X POST "https://vibecode.bitrix24.com/v1/files/42/public-link" -H "X-Api-Key: YOUR_API_KEY"

curl — application key

Terminal

curl -X POST "https://vibecode.bitrix24.com/v1/files/42/public-link" -H "X-Api-Key: YOUR_APP_KEY"

JavaScript — personal key

javascript

const response = await fetch("https://vibecode.bitrix24.com/v1/files/42/public-link", {
  method: "POST",
  headers: { "X-Api-Key": "YOUR_API_KEY" },
});
const data = await response.json();

JavaScript — application key

javascript

const response = await fetch("https://vibecode.bitrix24.com/v1/files/42/public-link", {
  method: "POST",
  headers: { "X-Api-Key": "YOUR_APP_KEY" },
});
const data = await response.json();

Response

JSON

{"success":true,"data":{"url":"https://bitrix24public.com/example.bitrix24.com/file/EXAMPLE_LINK","revocableViaApi":false},"meta":{"inTrash":false}}

Response fields

Field	Type	Description
success	boolean	true
data.url	string	Public access secret
data.revocableViaApi	boolean	false
meta.inTrash	boolean	Trash state

Limitations and errors

File links require the portal disk_manual_external_link feature; an unavailable plan returns 403 DISK_PUBLIC_LINK_PLAN_UNAVAILABLE.

403 BITRIX_ACCESS_DENIED means no permission to change the object or public links are disabled on the portal; Bitrix24 does not distinguish these reasons. 404 ENTITY_NOT_FOUND means the object is absent. 422 DISK_PUBLIC_LINK_REFUSED means no link was returned. Writes are never automatically retried; 502 DISK_OUTCOME_UNKNOWN requires reading state before deciding whether to retry. Not supported in batch.

To permanently remove the object, use purge.

Bitrix24 method: disk.file.getExternalLink.

400 — malformed path id:

JSON

{"success":false,"error":{"code":"INVALID_ID","message":"id must be a positive safe integer."}}