Analytics sharing

Analytics Share creates an unlisted, read-only presentation link for one published Analytics API. It is useful when a customer, partner, operator, or stakeholder needs the governed result without Dashboard access or a Runtime API Key.

The share does not copy data or create a second query definition. Every request executes the original Analytics API through its active binding and existing runtime contract.

Create a share#

1. Open the published Analytics API in Dashboard.
2. Select Share.
3. Optionally enter a password.
4. Select Create share and copy the generated link.

The Analytics API must be enabled and published. Creating or managing a share requires project mutation access. A password is optional and may contain at most 72 bytes.

The public URL uses this form:

https://www.reportplane.com/data/share/SHARE_TOKEN

The token is generated from cryptographically secure random bytes. The page is intentionally unlisted: it is excluded from the public catalog and sitemap, and search engines receive noindex/robots restrictions. Treat the URL as a bearer secret when no password is configured.

What the recipient can do#

The recipient can:

• view the saved chart, including map and other supported visualization metadata;
• see the Analytics description and reported source freshness;
• use only the request-time filters explicitly allowed by the Analytics API;
• refresh the governed result for that one Analytics API.

The recipient cannot browse the project, warehouse credentials, data model, other Analytics APIs, Query Clients, or Shared Datasets. The share is read-only and does not grant ingest or management access.

Governing contract remains authoritative#

Sharing does not widen the Analytics definition. These settings remain authoritative:

• fixed filters and allowed runtime filters;
• permitted filter operators;
• output dimensions, metrics, aliases, order, and row limits;
• chart type and visualization metadata;
• the preferred destination binding;
• cache TTL and runtime row limits;
• workspace/project usage and execution accounting.

Queries still pass through the canonical Analytics runtime. They do not accept arbitrary SQL or arbitrary model fields.

Password protection#

When a password is configured, the first successful query issues a signed access grant that the Data app stores in a secure HttpOnly, SameSite cookie for up to 12 hours. The password itself is not stored in the browser grant and is stored by Core only as a password hash.

Password protection gates Analytics execution and result data. The share page metadata—including the Analytics name, description, chart type, freshness status, and allowed filter field descriptions—may still be visible to someone who has the token URL before they enter the password. Do not place secrets in Analytics names or descriptions.

Changing the password replaces the previous protection immediately. Saving an empty password removes password protection and makes the token-only link accessible without a password.

Revoke or recreate#

Open Manage share on the Analytics API and select Revoke link. The current token stops resolving immediately. Creating a later share generates a new token; the revoked URL is not reused.

A share also fails closed when the Analytics API is unpublished, disabled, or archived; its model, preferred binding, or destination becomes unavailable; or the publisher loses the required resource lifecycle state.

Privacy and caching#

Public share metadata and query responses use private, no-store cache semantics. Password grants are scoped to the individual share token. Share pages are not catalog entries and are not intended for search discovery.

This does not disable the Analytics API's warehouse-result cache policy. It prevents browsers and intermediaries from treating the share response itself as public cacheable content.

Analytics Share versus Shared Dataset#

Capability	Analytics Share	Shared Dataset
Primary purpose	Let someone view one governed result	Let another ReportPlane project build Analytics over selected models
Consumer account required	No	Yes
Scope	One Analytics API	Selected shared models and published charts
Mutability	Read-only presentation	Consumer may create its own Analytics definitions over the binding
Discovery	Unlisted token URL	Unlisted or approved public catalog listing
Credentials exposed	Never	Never

Use Analytics Share for a focused view. Use a Shared Dataset when the consumer needs reusable model access inside ReportPlane.

Related access paths#

• Use a Query Client or Runtime API Key when an application must call published Analytics APIs programmatically.
• Use an Analytics App when you need a multi-view application rather than one shared chart.
• Use Analytics Explorer for authenticated investigation before publishing or sharing.