Set an absolute expiration time
Pass expiresAt as an ISO 8601 timestamp when creating the link. Store and display that same timestamp in your own system so operators understand when delivery will stop.
{
"url": "https://example.com/invoices/INV-8421/download",
"expiresAt": "2026-12-31T23:59:59Z"
}Treat expiration as irreversible
A scheduled expiration or the expire-now endpoint permanently retires the link. Future requests receive HTTP 410 Gone. Use pause instead when there is any chance the link should become active again.
Decide what the calling application should show
API clients should display expiration state alongside the link and destination. Message workflows should avoid distributing a link too close to its expiration unless the short lifetime is intentional.
Keep old links in operational reports
Expired links remain useful as an audit record. Retain their identifier, destination, creation time, and expiration time for as long as your own retention policy requires, even though redirect delivery has stopped.