Share a repository

A repository belongs to the account that created it. The owner can make it public, share it with individual people, and grant tokens access to it.

Visibility

A repository is Private or Public.

Visibility	Who can read	Who can deploy
Private	The owner, the people it's shared with, and the tokens granted access	Anyone with write permission
Public	Anyone, including builds with no credentials	Anyone with write permission

To change it, follow these steps:

1. Open the repository and go to Settings.
2. Under Visibility, select Private or Public.
3. Click Save changes.

Making a repository public makes every file in it readable by anyone. Check what's in it first.

A private repository looks like it doesn't exist to someone who can't read it: the pages answer 404 Not Found rather than saying that access was refused.

Roles

Role	Can do
Read	Resolve and download files, browse, search, and read the file activity
Write	Everything read can do, plus deploy files, delete files and versions where the settings allow it, and publish the index
Admin	Everything write can do, plus change settings, manage upstreams and content rules, manage sharing, manage custom domains, and read the settings activity

The owner is always an administrator and can't be removed. Only the owner can delete the repository.

Share with a person

To share a repository, follow these steps:

1. Open the repository and go to Access.
2. In the Handle field, enter the person's CodeSoh handle.
3. Under Permission, select Read, Write, or Admin.
4. Click Share.

They can then reach the repository in their browser and with their own tokens. Granting a permission to someone who already has one replaces it.

Handles that don't belong to a CodeSoh account are refused. The owner can't be added, because the owner already has every permission.

To stop sharing, follow these steps:

1. Open the repository and go to Access.
2. In the person's row, click Remove.

Removing a person also removes the grants of every token they own in this repository, so their build tools lose access at the same moment they do.

Tokens

A personal access token is a separate subject. It reaches nothing until it's granted a permission in a repository, and it never reaches more than its owner does.

Two rules follow from that:

• You can't grant a token more than you hold yourself. If you have read permission, you can grant your token read permission, not write permission.
• If your own permission is later reduced, your token's access is reduced with it, without anything having to be changed on the token.

A token can hold read or write permission. Administering is done by a person, not by a token.

For how to grant and remove them, see Tokens in Artifex.

What each request needs

Request	Permission needed	Answer without it
GET or HEAD of a file	Read	401 with no credentials, 403 with credentials
PUT of a file	Write	401 with no credentials, 403 with credentials
DELETE of a file	Write, and Allow deleting files turned on	401, 403, or 403 from the setting
Repository pages	Read	404, so a private repository stays hidden
Settings, upstreams, sharing, domains	Admin	403