POST /api/v1/creative-hub/share (body: email). Shares your ENTIRE Drive folder as role=writer + type=user. Revoke via /unshare, list via /shared-emails. Survives until revoked.

Share folder with external collaborators

POST /api/v1/creative-hub/share (verified apps/backend/src/routes/api/creative-hub-sharing.route.ts). The request body is just { email } — there is no per-file share. Wevion grants the given email role='writer' + type='user' on your entire Creative Hub folder via the Google Drive permissions API. The granted user receives a Drive notification and can open the folder directly in Drive. Revoke with POST /api/v1/creative-hub/unshare; list current grants with GET /api/v1/creative-hub/shared-emails. Permission survives until explicitly revoked.

Who is this for

Anyone collaborating with external parties (client reviewers, agency partners, freelancers) who need to access ad creatives without a Wevion account.

How it works

Wevion's Creative Hub stores files on Google Drive via a Service Account, which owns your folder. To grant external access, Wevion calls Drive's permissions API to add the external email as a writer on your entire user folder (not on a single file).

After sharing:

• The external user receives a Drive notification email
• They can open the folder directly in Drive (no Wevion account needed)
• They can preview, download, and edit its contents (writer permission)
• The share persists in Drive until explicitly revoked

How to share

Step 1: Open the share dialog

Open the Creative Hub share option (there is no per-file share — sharing grants access to your whole folder).

Step 2: Enter email

Modal opens with an email input. Enter the collaborator's email (Gmail or any address — Drive handles non-Gmail by sending an invitation).

Step 3: Confirm

Click Share. POST /api/v1/creative-hub/share runs with body { email }. Backend:

1. Resolves (or creates) your Drive folder via ensureUserFolder
2. Calls the Drive permissions API with { role: 'writer', type: 'user', emailAddress } on that folder
3. Saves the sharing record and returns the updated list of authorized emails

The collaborator receives Drive's notification email.

Step 4: Confirm in UI

The modal returns the updated authorized-emails list. You can view current grants any time via GET /api/v1/creative-hub/shared-emails.

What the collaborator sees

• Drive notification email: the Service Account shared a folder with them
• Click link → opens your Creative Hub folder in Drive
• Can preview / download / edit its contents
• Sees everything in your Creative Hub folder (the share is folder-level, not per-file)

Revoking a share

Use the shared-emails list → remove the email. This calls POST /api/v1/creative-hub/unshare, which removes the Drive permission. The collaborator loses access immediately (next time they open the folder, Drive returns 403).

Sharing scope

Sharing is all-or-nothing at the folder level — you grant an email access to your entire Creative Hub folder (and everything inside it, via Drive's cascade). There is no per-file or per-subfolder share in the Creative Hub flow. If you need to share only a subset, put those assets in a separate account/folder, or share them directly from Google Drive outside Wevion.

Limits

• Number of shares per file: Drive enforces limits (typically thousands but watch quota in /settings → Integrations → Google Drive)
• Sharing with non-Gmail: works — Drive sends invitation; collaborator creates Drive account or uses single sign-on
• Share notification language: Drive's default (usually English; some locale support)

Tracking active shares

Shares are not written to the Wevion audit log — there is no creative_share / creative_unshare (or any creative_*) audit action in the code. Instead, the current grants are stored as a sharing record and returned by GET /api/v1/creative-hub/shared-emails; use that endpoint (or the share dialog) to see who currently has access.

Compliance considerations

External sharing means data leaves your Wevion workspace boundary into Drive's permissions model. For sensitive content:

• Remember the share is folder-level — the collaborator sees your whole Creative Hub folder
• Periodically review active grants via GET /api/v1/creative-hub/shared-emails
• Revoke promptly when the engagement ends

For GDPR / data residency: shared files inherit Drive's data storage region (your workspace's Drive region). Collaborator's access is controlled by Wevion's revoke flow.

Common mistakes

• Forgetting the share is folder-level: the collaborator gets your entire Creative Hub folder, not a single file. Don't share if the folder holds anything sensitive.
• Sharing without reviewing: grants accumulate; periodically check GET /api/v1/creative-hub/shared-emails and revoke stale ones.
• Expecting a read-only share: Wevion's flow grants writer (read + edit); there is no reader-only option in the Creative Hub share flow.
• Sharing with a typo email: Drive silently sends the invitation to the wrong address. Verify spelling.
• Confusing Drive share with Wevion team-folder visibility: they're different layers. Drive share = external collaborator access via Drive UI. Wevion team folder = teammate visibility within Wevion UI (see ch-104).

FAQ

How does external sharing work in Creative Hub?

Wevion's Creative Hub stores files on Google Drive via a Service Account, so to share externally it calls Drive's permissions API (POST /api/v1/creative-hub/share, body { email }) to add the collaborator's email as a writer (role='writer', type='user') on your entire Creative Hub folder. The external user gets a Drive notification email and can open, preview, download, and edit its contents directly in Drive — no Wevion account needed.

Do external collaborators need a Wevion account?

No — external collaborators access the shared folder directly through Google Drive, not Wevion. They receive a Drive notification email, click the link, and can preview, download, and edit its contents. Note the share is folder-level: they see everything in your Creative Hub folder, not a single file.

How do I revoke external access?

Open the shared-emails list in Wevion's Creative Hub and remove the email. This calls POST /api/v1/creative-hub/unshare, which removes the Drive permission, and the collaborator loses access immediately — Drive returns a 403 the next time they try to open the folder.

Can I share just one file instead of my whole folder?

No — the Creative Hub share flow is folder-level only. Sharing grants the collaborator writer access to your entire Creative Hub folder (and everything inside it via Drive's cascade). If you need to share only a subset, keep those assets in a separate account/folder or share them directly from Google Drive outside Wevion.

Are external shares tracked for compliance?

Shares are not written to the Wevion audit log — there is no creative_share / creative_unshare audit action. The current grants are kept as a sharing record and returned by GET /api/v1/creative-hub/shared-emails. Since external sharing moves data into Drive's permissions model and is folder-level, review active grants regularly and revoke promptly when an engagement ends.

Related articles

• Creative permissions and access
• Google Drive settings