qURL

Mint Access Link

mint_link

Instructions

Mint a fresh access link for an existing qURL resource — same one-shot display semantics as create_qurl.qurl_link. Use this to issue additional access links to a resource without creating a brand-new qURL (e.g. a second recipient, a replacement after the original was lost). Not for files from the upload tools: their links come from the file connector, so a link minted here on an upload's resource_id does not open the file; run the upload tool again instead. Use create_qurl instead when you want a brand-new resource with its own target_url and policy. Use update_qurl when you only want to change expiration/tags/description on the existing resource. Accepts resource public keys, CRIDs, legacy r_ IDs, and q_ display IDs. Constraints: expires_in and expires_at are mutually exclusive (handler returns an isError: true content block before any API call if both are set). If neither expiry field is specified, the API defaults to 24 hours from now. Output: the new qurl_link is shown ONCE — no subsequent call returns it. Capture qurl_id if you need to correlate future access events or update this specific token.

Input Schema

Name	Required	Description
`label`	No	Human-readable label identifying who this link is for (max 500 chars)
`expires_at`	No	Absolute expiration timestamp (RFC 3339). Mutually exclusive with expires_in
`expires_in`	No	Relative duration until expiration (e.g., "5m", "24h", "7d"; the API enforces 1m to 30d). Mutually exclusive with expires_at
`resource_id`	Yes	The resource public key, CRID, legacy r_ ID, or qURL display ID (q_ prefix) to mint a new access link for. If a q_ ID is passed, the API resolves it to the parent resource automatically.
`max_sessions`	No	Maximum concurrent sessions for this qURL token (0 = unlimited, max 1000)
`one_time_use`	No	Whether this link can only be used once
`access_policy`	No	Access control policy for this link
`session_duration`	No	How long access lasts after clicking (e.g., "1h"). Rejected if it exceeds the parent resource's session-duration cap.

Output Schema

Name	Required	Description
`type`	No	Resource type echoed from the underlying resource
`qurl_id`	Yes	Display-friendly qURL ID (q_ prefix) for the minted token
`qurl_link`	Yes	Newly minted access link with one-shot display semantics, like create_qurl
`expires_at`	No
`branded_domain`	No	Bare branded hostname for anchor text when the resource has a usable custom domain
`email_delivery`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv0.2.2Oct 14, 2026

changedInput schema / properties / expires_in / description

Previous value: -"Relative duration until expiration (e.g., \"5m\", \"24h\", \"7d\"). Mutually exclusive with expires_at"New value: +"Relative duration until expiration (e.g., \"5m\", \"24h\", \"7d\"; the API enforces 1m to 30d). Mutually exclusive with expires_at"

Changed38 schema fields changedv0.2.1Sep 19, 2026

removedInput schema / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / access_policy / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / access_policy / properties / ai_agent_policy / additionalProperties
```
Removed value: -false
```

changedInput schema / properties / access_policy / properties / ai_agent_policy / properties / allow_categories / description

Previous value: -"AI agent categories to permit (all others blocked)"New value: +"AI agent categories to permit (all others blocked; max 20 entries, 128 chars each)"

addedInput schema / properties / access_policy / properties / ai_agent_policy / properties / allow_categories / items / maxLength
```
Added value: +128
```
addedInput schema / properties / access_policy / properties / ai_agent_policy / properties / allow_categories / items / minLength
```
Added value: +1
```
addedInput schema / properties / access_policy / properties / ai_agent_policy / properties / allow_categories / maxItems
```
Added value: +20
```

changedInput schema / properties / access_policy / properties / ai_agent_policy / properties / deny_categories / description

Previous value: -"AI agent categories to block (e.g., gptbot, commoncrawl)"New value: +"AI agent categories to block (e.g., gptbot, commoncrawl; max 20 entries, 128 chars each)"

addedInput schema / properties / access_policy / properties / ai_agent_policy / properties / deny_categories / items / maxLength
```
Added value: +128
```
addedInput schema / properties / access_policy / properties / ai_agent_policy / properties / deny_categories / items / minLength
```
Added value: +1
```
addedInput schema / properties / access_policy / properties / ai_agent_policy / properties / deny_categories / maxItems
```
Added value: +20
```

changedInput schema / properties / access_policy / properties / geo_allowlist / description

Previous value: -"Allowed country codes (ISO 3166-1 alpha-2)"New value: +"Allowed country codes (ISO 3166-1 alpha-2; max 50 entries, 8 chars each)"

addedInput schema / properties / access_policy / properties / geo_allowlist / items / maxLength
```
Added value: +8
```
addedInput schema / properties / access_policy / properties / geo_allowlist / items / minLength
```
Added value: +1
```
addedInput schema / properties / access_policy / properties / geo_allowlist / maxItems
```
Added value: +50
```

changedInput schema / properties / access_policy / properties / geo_denylist / description

Previous value: -"Denied country codes (ISO 3166-1 alpha-2)"New value: +"Denied country codes (ISO 3166-1 alpha-2; max 50 entries, 8 chars each)"

addedInput schema / properties / access_policy / properties / geo_denylist / items / maxLength
```
Added value: +8
```
addedInput schema / properties / access_policy / properties / geo_denylist / items / minLength
```
Added value: +1
```
addedInput schema / properties / access_policy / properties / geo_denylist / maxItems
```
Added value: +50
```

changedInput schema / properties / access_policy / properties / ip_allowlist / description

Previous value: -"Allowed IP addresses or CIDR ranges"New value: +"Allowed IP addresses or CIDR ranges (max 100 entries, 64 chars each)"

addedInput schema / properties / access_policy / properties / ip_allowlist / items / maxLength
```
Added value: +64
```
addedInput schema / properties / access_policy / properties / ip_allowlist / items / minLength
```
Added value: +1
```
addedInput schema / properties / access_policy / properties / ip_allowlist / maxItems
```
Added value: +100
```

changedInput schema / properties / access_policy / properties / ip_denylist / description

Previous value: -"Denied IP addresses or CIDR ranges"New value: +"Denied IP addresses or CIDR ranges (max 100 entries, 64 chars each)"

addedInput schema / properties / access_policy / properties / ip_denylist / items / maxLength
```
Added value: +64
```
addedInput schema / properties / access_policy / properties / ip_denylist / items / minLength
```
Added value: +1
```
addedInput schema / properties / access_policy / properties / ip_denylist / maxItems
```
Added value: +100
```

changedInput schema / properties / access_policy / properties / user_agent_allow_regex / description

Previous value: -"Regex to allow matching user agents"New value: +"Regex to allow matching user agents (max 256 chars)"

addedInput schema / properties / access_policy / properties / user_agent_allow_regex / maxLength
```
Added value: +256
```

changedInput schema / properties / access_policy / properties / user_agent_deny_regex / description

Previous value: -"Regex to deny matching user agents"New value: +"Regex to deny matching user agents (max 256 chars)"

addedInput schema / properties / access_policy / properties / user_agent_deny_regex / maxLength
```
Added value: +256
```

addedInput schema / properties / expires_at / pattern

Added value: +"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"

changedInput schema / properties / max_sessions / description

Previous value: -"Maximum concurrent sessions (0 = unlimited, max 1000)"New value: +"Maximum concurrent sessions for this qURL token (0 = unlimited, max 1000)"

changedInput schema / properties / resource_id / description

Previous value: -"The resource ID (r_ prefix) or qURL display ID (q_ prefix) to mint a new access link for. If a q_ ID is passed, the API resolves it to the parent resource automatically."New value: +"The resource public key, CRID, legacy r_ ID, or qURL display ID (q_ prefix) to mint a new access link for. If a q_ ID is passed, the API resolves it to the parent resource automatically."

removedInput schema / properties / resource_id / minLength
```
Removed value: -1
```

addedInput schema / properties / resource_id / pattern

Added value: +"(?:^(r_[a-z0-9_-]{11}|(?:[A-Za-z0-9_-]{4}){27,53}|(?:[A-Za-z0-9_-]{4}){27,53}[A-Za-z0-9_-]{2}|(?:[A-Za-z0-9_-]{4}){26,52}[A-Za-z0-9_-]{3}|[a-z2-7]{47}|[a-z2-7]{60})$)|(?:^q_[0-9a-f]{11}$)"

changedInput schema / properties / session_duration / description

Previous value: -"How long access lasts after clicking (e.g., \"1h\")"New value: +"How long access lasts after clicking (e.g., \"1h\"). Rejected if it exceeds the parent resource's session-duration cap."

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "properties": {
+    "branded_domain": {
+      "description": "Bare branded hostname for anchor text when the resource has a usable custom domain",
+      "type": "string"
+    },
+    "email_delivery": {
+      "additionalProperties": false,
+      "properties": {
+        "attempted": {
+          "type": "boolean"
+        },
+        "enabled": {
+          "type": "boolean"
+        },
+        "failed": {
+          "type": "number"
+        },
+        "recipients": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "results": {
+          "items": {
+            "additionalProperties": false,
+            "properties": {
+              "email": {
+                "type": "string"
+              },
+              "error": {
+                "type": "string"
+              },
+              "message_id": {
+                "type": "string"
+              },
+              "skipped": {
+                "type": "boolean"
+              },
+              "success": {
+                "type": "boolean"
+              }
+            },
+            "required": [
+              "email",
+              "success",
+              "skipped"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "sent": {
+          "type": "number"
+        },
+        "skipped_reason": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "attempted",
+        "enabled",
+        "recipients",
+        "sent",
+        "failed",
+        "results"
+      ],
+      "type": "object"
+    },
+    "expires_at": {
+      "type": "string"
+    },
+    "qurl_id": {
+      "description": "Display-friendly qURL ID (q_ prefix) for the minted token",
+      "type": "string"
+    },
+    "qurl_link": {
+      "description": "Newly minted access link with one-shot display semantics, like create_qurl",
+      "type": "string"
+    },
+    "type": {
+      "description": "Resource type echoed from the underlying resource",
+      "type": "string"
+    }
+  },
+  "required": [
+    "qurl_id",
+    "qurl_link"
+  ],
+  "type": "object"
+}

First observedv0.2.0Apr 27, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only convey the generic write/non-idempotent/open-world profile. The description adds behavior annotations cannot express: the link is displayed exactly once with no way to retrieve it later, capture qurl_id for correlation, the handler short-circuits with isError:true before any API call when both expiry fields are set, and a 24-hour default when neither is given. That is substantive beyond structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose leads, alternatives and exclusions follow, then constraints and output notes — a sensible front-loaded order with no filler sentences. It is dense (inline code, bolded constraint/output markers) and slightly long, but nearly every clause carries operative guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present the description need not enumerate return fields, yet it still supplies the critical non-obvious output behavior (one-shot link display, keep qurl_id). Combined with the sibling routing, upload caveat, and conflict/default rules, an agent has everything needed to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents resource_id ID formats, the expires_in/expires_at exclusivity, duration formats, and the access_policy nests. The description restates the ID-format acceptance and the mutual-exclusion constraint rather than adding new syntax or defaults, so it clears the baseline but does not exceed it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Mint a fresh access link for an existing qURL resource') and immediately frames it against siblings by naming create_qurl and update_qurl with the conditions that separate them. An agent can distinguish this from every other qURL tool without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use (issue additional links to an existing resource for a second recipient or replacement) plus two named alternatives with their selection conditions (create_qurl for a new resource, update_qurl to change metadata). It also states when NOT to use it: links for upload-tool files come from the file connector, and a link minted on an upload's resource_id will not open the file. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server