Security

Access controls

Your backend sets the limits on each qURL™ when it issues the link, and can withdraw access afterwards. These are the controls the qURL API documents today.

Limits on a link

Opening deadlineexpires_in: How long the link can be opened: 1 minute to 30 days. Connector links default to 5 minutes. A resource’s own expiry can shorten it.
Single useone_time_use: The link is used up by its first successful opening. Connector links are single-use by default unless you allow more than one session.
Concurrent sessionsmax_sessions: Up to 1,000 sessions at once per qURL, or 0 for no limit. Visitors sharing a source IP count as one session.
Session lengthsession_duration: How long access keeps accepting new requests after the recipient first reaches the app: 1 second to 24 hours. Connector sessions default to 1 hour. Separate from the opening deadline.
Resource session capsession_duration_cap: A maximum session length set when the resource is created. Links issued later can’t exceed it.

Withdrawing access

Revoke a qURLDELETE /v1/resources/{id}/qurls/{qurl_id}: Revokes the link and its live sessions, including sessions from links that were already used or have expired. Other qURLs on the same resource are unaffected. A 503 means revocation is committed but enforcement is still pending: retry after Retry-After to confirm it finished.
End sessions/v1/resources/{id}/sessions: List a resource’s active sessions, then end one of them or all of them.

Access events

Webhooks send events to an HTTPS endpoint you choose, signed with HMAC in the QURL-Signature header. Each delivery’s status and retries can be looked up through the API.

Delivered today: qurl.accessed, qurl.access_denied, qurl.revoked, qurl.token_exhausted, qurl.created and qurl.updated, among others.
Not delivered yet: qurl.expired and resource.closed are defined, but subscribing to them doesn’t turn on delivery yet.

These controls limit and withdraw access; they don’t identify a person. A qURL is a bearer credential, so pair it with your own sign-in. Webhooks and session lists are integration points, not a retained audit log.

API reference How it works

Details worth knowing

A qURL is a bearer credential: Whoever holds a usable link can try to open it. Issuing it after sign-in doesn’t by itself tie it to one person, so deliver it privately and keep opening deadlines short.
It isn’t a redirect to a public origin: The browser may navigate while a link opens, but approved traffic then runs through LayerV and the outbound connector, not straight to your app.
Opening deadline and session length differ: The deadline limits when a link can start access. Session length limits how long that access keeps accepting requests. One opening can carry many requests.
Revocation ends live sessions too: Revoking a qURL also ends its live sessions. If the API reports that enforcement is still pending, your client retries to confirm it finished.