# Access controls > The limits each qURL carries, how to withdraw access, and the access events LayerV sends, as documented in the qURL API. Source: https://layerv.ai/security/access-controls/ --- Security # Access controls Your backend sets the limits on each qURL™ when it issues the link, and can withdraw access afterwards. These are the controls the qURL API documents today. ## Limits on a link Opening deadline `expires_in` How long the link can be opened: 1 minute to 30 days. Connector links default to 5 minutes. A resource’s own expiry can shorten it. Single use `one_time_use` The link is used up by its first successful opening. Connector links are single-use by default unless you allow more than one session. Concurrent sessions `max_sessions` Up to 1,000 sessions at once per qURL, or 0 for no limit. Visitors sharing a source IP count as one session. Session length `session_duration` How long access keeps accepting new requests after the recipient first reaches the app: 1 second to 24 hours. Connector sessions default to 1 hour. Separate from the opening deadline. Resource session cap `session_duration_cap` A maximum session length set when the resource is created. Links issued later can’t exceed it. ## Withdrawing access Revoke a qURL `DELETE /v1/resources/{id}/qurls/{qurl_id}` Revokes the link and its live sessions, including sessions from links that were already used or have expired. Other qURLs on the same resource are unaffected. A `503` means revocation is committed but enforcement is still pending: retry after `Retry-After` to confirm it finished. End sessions`/v1/resources/{id}/sessions` List a resource’s active sessions, then end one of them or all of them. ## Access events Webhooks send events to an HTTPS endpoint you choose, signed with HMAC in the `QURL-Signature` header. Each delivery’s status and retries can be looked up through the API. Delivered today `qurl.accessed`, `qurl.access_denied`, `qurl.revoked`, `qurl.token_exhausted`, `qurl.created` and `qurl.updated`, among others. Not delivered yet `qurl.expired` and `resource.closed` are defined, but subscribing to them doesn’t turn on delivery yet. These controls limit and withdraw access; they don’t identify a person. A qURL is a bearer credential, so pair it with your own sign-in. Webhooks and session lists are integration points, not a retained audit log. [API reference](https://layerv.ai/docs/) [How it works](https://layerv.ai/platform/#how-it-works) ## Details worth knowing A qURL is a bearer credential Whoever holds a usable link can try to open it. Issuing it after sign-in doesn’t by itself tie it to one person, so deliver it privately and keep opening deadlines short. It isn’t a redirect to a public origin The browser may navigate while a link opens, but approved traffic then runs through LayerV and the outbound connector, not straight to your app. Opening deadline and session length differ The deadline limits when a link can start access. Session length limits how long that access keeps accepting requests. One opening can carry many requests. Revocation ends live sessions too Revoking a qURL also ends its live sessions. If the API reports that enforcement is still pending, your client retries to confirm it finished. --- *This markdown version is auto-generated from [https://layerv.ai/security/access-controls/](https://layerv.ai/security/access-controls/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*