Protect public application tokens
Treat invite URLs as bearer links and revoke unused invitations.
Before you start
Use the account and administrative authority appropriate to the data. Retention and legal holds are separate from routine record editing.
Follow these steps
- Identify the account, record type and evidence affected by this task.
- Treat invite URLs as bearer links and revoke unused invitations.
- Default invite TTL is 14 days; do not send links to unintended recipients.
- Use the supported workflow and verify its saved audit or access result.
Fields, rules and limits
- Default invite TTL is 14 days; do not send links to unintended recipients.
- An invitation is bound to a property and recipient and can be used once. Resending replaces the usable invitation; a revoked, used or expired token cannot start another submission. The default lifetime is 14 days, subject to the workspace option.
Check it worked
The relevant access, retention or evidence control has a verified result.
If something does not look right
If the expected result is missing, check the saved record, the current workspace and the action’s permissions. Record the exact validation message; do not repeat a state-changing action until you know whether the first attempt saved.
Questions and answers
What should I verify for this task?
Default invite TTL is 14 days; do not send links to unintended recipients. An invitation is bound to a property and recipient and can be used once. Resending replaces the usable invitation; a revoked, used or expired token cannot start another submission. The default lifetime is 14 days, subject to the workspace option.
Why is the record or action unavailable?
Use the account and administrative authority appropriate to the data. Retention and legal holds are separate from routine record editing. Check the current company and record relationship before requesting additional access.