Sharing and access
How Celiq controls who sees your work — Vault access by user or role, plus public share links for Prisms, Mosaics, and Reveals.
When to use it — Whenever you want a colleague to open a Prism, Mosaic, or Workbook you built, or you want to drop a quick link to a saved result into Slack or email.
Where to find it — Vault access lives under Vaults → (a vault) → Manage Access. Share links come from the ⋯ / Copy share link action on Discover and on a Prism's detail page.
Who can use it — Anyone can copy a share link for content they can already open. Granting or removing Vault access requires Weaver or Luminary.
Celiq separates where content lives from who can open it. Content lives in Vaults (see Vaults), and access is decided in two ways. The primary, durable control is Vault access: you grant a person — or an entire role — a level of access to a vault, and that grant covers every Prism, Mosaic, and Workbook inside it. The secondary, lightweight control is a share link: a single tokenized URL pointing at one item, which you can paste anywhere.
This page covers both, plus how public share links actually behave, so you can pick the right tool and avoid over-sharing.
Overview
Two mechanisms, two jobs:
- Vault access — Long-lived, role-aware. Add a user (or every user with a given role) to a vault and choose View, Edit, or Full. This is how teams get standing access to a body of work.
- Share links — Short, disposable, tokenized. Generated for a single Prism, Mosaic, Workbook, or saved Reveal. The link goes to a public
/share/<token>page that names the report and invites the viewer to sign in to Celiq to see the full result. Links can carry an expiry and their views are counted.
A useful way to hold the two apart: Vault access decides what shows up in someone's Celiq workspace; a share link is a pointer you hand to one person at one moment.
When to use it
| You want to… | Use |
|---|---|
| Give your team standing access to a folder of dashboards | Vault access (add the role, e.g. all Tracers) |
| Let one analyst edit Prisms in a shared vault | Vault access at Edit |
| Drop a link to a single result into a Slack thread | A share link from Copy share link |
| Hand someone a link that stops working after a month | A share link with an expiry |
| Let a teammate open a Mosaic you just built | Either — Vault access if it's ongoing, a share link if it's one-off |
Concepts
Define these once and the rest of the page reads cleanly.
- Vault — A folder that holds Prisms, Mosaics, and Workbooks. Access is granted at the vault level. A personal vault is private to its owner and is hidden from everyone except its owner and Luminaries.
- Grantee — Who an access grant points at. Celiq supports two grantee types: an individual user, or an entire role (for example, "All Tracers"). A role grant applies to every current and future user with that role.
- Access level — One of three values on a vault grant: View, Edit, or Full.
- Owner — The user who created the vault. The owner always resolves to Full access on their own vault.
- Share link — A tokenized, public URL (
/share/<token>) generated for one item. It can have an optional expiry and tracks a view count. - Resource type — What a share link points at: a Prism, Mosaic, Workbook, or a saved Reveal / domain.
Getting started
Prerequisites:
- To grant or remove Vault access, you must be a Weaver or Luminary.
- To copy a share link, you only need to be able to open the item yourself.
- A Luminary automatically has Full access to every vault in the workspace and sees all vaults — including personal ones.
To open Vault access management: go to Vaults, open the vault, and click Manage Access. The Manage Access button appears for users who hold Full access on that vault.
Step-by-step
Decide: standing access or a one-off link
If the person needs ongoing access to a body of work, use Vault access. If you just want to send one result right now, generate a share link instead.
Grant Vault access (Weaver or Luminary)
Open Vaults, select the vault, and click Manage Access. In the Manage Access dialog, search for a person and pick their level (View, Edit, or Full), or grant a whole role — the list shows role grants as "All Tracers", "All Weavers", and so on. Each grant is saved immediately.
Adjust or remove a grant
In the same dialog, change a grantee's level with the dropdown next to their name, or remove the grant entirely. Removing a grant revokes that person's (or role's) access to everything in the vault.
Copy a share link from Discover
With a saved Reveal open in Discover, click the ⋯ menu and choose Copy share link. Celiq mints a tokenized link (with a 30-day expiry) and copies it to your clipboard.
Copy a share link from a Prism
Open the Prism's detail page and use its share action. Celiq returns a share_token and copies https://app.celiq.co/share/<token> to your clipboard, confirming with "Share link copied!".
Send the link
Paste the link into Slack, email, or a doc. When the recipient opens it, they see a Celiq-branded page naming the shared report with a prompt to sign in to view the full result.
Examples
A realistic setup for a small analytics team:
You build a Q2 Revenue vault containing three Mosaics. You want every analyst to see them and a couple of Weavers to be able to edit. In Manage Access you add a role grant for all Tracers at View, then add two individual Weavers at Edit. New analysts who join later as Tracers inherit View access automatically because the grant is on the role, not on each person.
Separately, your VP asks for "just that one chart." Rather than adding them to the vault, you open the Prism and use Copy share link. The request that creates it looks like this:
{
"resource_type": "prism",
"resource_id": "9f3c…",
"expires_in_days": 30
}Celiq verifies the Prism belongs to your workspace, mints a token, and returns:
{
"token": "kQ7r…",
"url": "https://app.celiq.co/share/kQ7r…",
"expires_at": "2026-07-27T00:00:00.000Z"
}You paste that URL into an email. It works for 30 days and stops resolving after that.
Best practices
- Prefer role grants for teams. Granting "All Tracers" once is far less maintenance than adding each analyst individually, and new hires inherit access automatically.
- Use the smallest level that works. Grant View by default; reserve Edit for people who genuinely build, and Full for people who must manage the vault's own membership.
- Reach for share links for one-offs. If access is momentary, a tokenized link is cleaner than adding someone to a vault you'll have to clean up later.
- Set an expiry when it matters. A share link can carry an
expires_in_daysvalue so it self-revokes. Discover links default to 30 days. - Keep sensitive work in personal vaults until it's ready — personal vaults are invisible to everyone but you and Luminaries.
Tips
A share link points at one item; it does not grant access to the vault around it. If you want a colleague to browse everything next to that item, add them to the Vault instead of sending link after link.
Common mistakes
/share/<token> page names the report and prompts the viewer to sign in — it is an entry point, not an anonymous data export. To actually open the result, the recipient still needs a Celiq account with access.Granting Full when you meant Edit. Full access lets the grantee change the vault's own membership, including removing you. Use Edit for builders who shouldn't manage access.
Sharing an item but not its vault. A recipient who lacks access to the item's vault cannot open it in the app even with a link. For ongoing access, grant Vault access.
Expecting a link to outlive its expiry. Once
expires_at passes, the link returns "Link not found or expired". Generate a fresh link if you need continued access.Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Recipient sees "Link not found or expired" | The link's expiry has passed, or the token is wrong/revoked | Generate a new share link from the item and resend it |
| "Resource not found in your workspace" when creating a link | The item being shared isn't owned by your workspace (e.g. a stale id) | Open the item directly and use its own Copy share link action |
| You can't see the Manage Access button on a vault | You don't hold Full access on that vault | Ask the vault owner or a Luminary to raise your level, or to make the change for you |
| A new analyst can't open the team's dashboards | Access was granted to specific people, not to the role | In Manage Access, add a role grant (e.g. all Tracers) so future hires inherit access |
| A vault you expected to see isn't listed | It's a personal vault owned by someone else | Personal vaults are private to their owner; ask them to move the content to a team vault or share a link |
| Recipient opens the link but only sees a sign-in prompt | This is expected — the public page is an entry point, not a data view | Have them sign in to Celiq with an account that has access to the item |