Share an order

Sharing an order grants another user access to it, with a specific role and optional extra permissions. Invitations are email-based, if the recipient doesn't have a Relu account, one is created and they receive setup instructions.

Invite a user

import requests

requests.post(
    f"https://api.automate.relu.ai/orders/{order_id}/share/invite",
    params={"send_invitation_email": True},
    json={
        "user_email": "colleague@example.com",
        "role_name": "editor",
        "country": "NL",
        "first_name": "Alex",
        "last_name": "Dupont",
    },
    headers={"X-API-Key": "<your_api_token>"},
)

await fetch(
  `https://api.automate.relu.ai/orders/${orderId}/share/invite?send_invitation_email=true`,
  {
    method: 'POST',
    headers: {
      'X-API-Key': process.env.RELU_API_TOKEN,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      user_email: 'colleague@example.com',
      role_name: 'editor',
      country: 'NL',
      first_name: 'Alex',
      last_name: 'Dupont',
    }),
  },
);

Fields

• user_email, required.
• role_name, viewer or editor. See the role matrix below.
• country, ISO 3166-1 alpha-2 country code ("NL", "US"). Required for new users; Relu needs it to comply with regional data rules.
• first_name / last_name, optional metadata shown in the UI.
• org_type, optional OrganizationType (dental_lab, dental_practice, …). Upserted onto the invitee's organization — only fills empty fields, never overwrites an existing value. If the invitee has no org yet, a new one is created with this value pre-filled.
• org_name, optional. Same upsert semantics as org_type.
• phone_number, optional contact phone for the invitee's organization (6-32 chars, must contain at least one digit). Same upsert semantics as org_type.
• granted_permissions, optional extra permissions on top of the role.
• revoked_permissions, optional permissions to remove from the role's defaults.

Set send_invitation_email=true to email setup instructions to the user. Set it to false for silent invites (common when you're using user tokens for a smooth flow).

Pass the optional language query parameter when the invitation may create an account. For example, language=en sets the new user's initial interface language. Existing users keep their saved preference. Supported values are en, nl, fr, de, es, it, ja, zh, ml, mr, and pt.

Marketing email opt-in

Two optional query params control whether a newly created invitee is opted into Relu's marketing emails (sent via Intercom):

• subscribe_to_news_updates (default false), opts into News & updates, product announcements and releases.
• subscribe_to_tips_onboarding (default false), opts into Tips & onboarding, educational content and getting-started tips.

Both default to false, so your end-users stay off Relu's marketing list unless you explicitly opt them in. The params are ignored when the email already belongs to a Relu user — the existing user's notification preferences always win. End-users can change their own preferences anytime from Settings → Notifications in the Relu app, or via the unsubscribe link in any marketing email.

Roles

Available permissions

Grant or revoke these via granted_permissions / revoked_permissions:

• order:approve, approve or unapprove the treatment
• order:unlock:implant_planning, unlock exports (creates usage charges)
• order:export:implant_planning, download exports
• order:export:implant_planning:report, download reports only
• order:export:implant_planning:guides, download surgical guides only
• order:download, download all order files
• order:change_permissions, manage who else has access

Typical patterns:

• End user who views but shouldn't cost you money: viewer and no extra permissions.
• Dentist who reviews and approves but doesn't print in-house: editor + order:approve, no export permissions.
• Lab technician who unlocks and downloads guides: editor + order:unlock:implant_planning + order:export:implant_planning:guides.

Create a public share link

Share links let someone access an order without being individually invited. They can have an expiry and can be revoked.

link = requests.post(
    f"https://api.automate.relu.ai/orders/{order_id}/share/links",
    json={
        "role_name": "viewer",
        "expires_at": "2026-05-01T00:00:00Z",
        "granted_permissions": ["order:download"],
    },
    headers={"X-API-Key": "<your_api_token>"},
).json()

# The response contains a token; build the shareable URL on your side.
share_url = (
    f"https://automate.relu.ai/viewer?orderId={order_id}&key={link['token']}"
)
print(share_url)

const link = await (
  await fetch(`https://api.automate.relu.ai/orders/${orderId}/share/links`, {
    method: 'POST',
    headers: {
      'X-API-Key': process.env.RELU_API_TOKEN,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      role_name: 'viewer',
      expires_at: '2026-05-01T00:00:00Z',
      granted_permissions: ['order:download'],
    }),
  })
).json();

// The response contains a token; build the shareable URL on your side.
const shareUrl = `https://automate.relu.ai/viewer?orderId=${orderId}&key=${link.token}`;
console.log(shareUrl);

The response contains a token. Build the shareable URL as https://automate.relu.ai/viewer?orderId={order_id}&key={token} — anyone with it gets the specified role on the order.

Manage existing sharing

List:

GET https://api.automate.relu.ai/orders/{order_id}/share

Update a user:

PUT https://api.automate.relu.ai/orders/{order_id}/share/users/{user_id}

Revoke a user:

DELETE https://api.automate.relu.ai/orders/{order_id}/share/users/{user_id}

Revoke a link:

DELETE https://api.automate.relu.ai/orders/{order_id}/share/links/{link_id}

See the API reference for full field details.

Related

• Sharing & permissions, model overview
• User tokens, short-lived tokens for end-user flows
• Draft order flow, how sharing fits the iframe pattern