How it works
Sharing data between two API owners involves three steps: 1. Create a sharing relation. The data owner (sender) creates a relation naming the receiver API owner. This relation starts inPENDING status.
2. Receiver accepts. The receiver changes the relation status to ALLOWED. Either side can later change it to BLOCKED. If the sender blocks the relation, the receiver cannot reactivate it.
3. Grant permissions per Leaf user. The sender grants READ access on specific resources (FIELDS, OPERATIONS) for individual Leaf users. The receiver can then query the standard field and operations endpoints to see the shared data.
Permissions are
READ only. The receiver cannot modify shared data. Company-level sharing is not supported, but you can grant or revoke permissions when adding or removing a Leaf user from a company.Endpoints
Base URL:https://api.withleaf.io/services/usermanagement/api
Sharing relations
RelationRole is either SENDER or RECEIVER, depending on which side is making the request.
Relation statuses: PENDING, ALLOWED, BLOCKED.
Leaf user permissions
Available permission resources
Example: granting field and operation access
What to do next
- Leaf Link for embedding provider connection and file upload widgets.
- Magic Link for generating shareable authentication URLs.
- Provider Organizations for controlling sync scope before sharing data.

