Nextcloud logo Nextcloud automation · runs weekly

Audit and remove old public share links in Nextcloud

Public links pile up in a Nextcloud over months, and nobody remembers which folder is still open to anyone who has the URL.

Cotlet does it in your own Nextcloud account with list_shares, list_files and remove_share, called by your AI agent, an n8n workflow or a script.

Sign up free All Nextcloud tools

Hosted · nothing to install or maintain

Can Nextcloud do this on its own?

Nextcloud has the Shares view in the UI and GET /shares in the Share API, which lists all shares of a user and can narrow them by path (checked 16 Oct 2026). Neither flags a missing password or expiry, and nothing runs the review for you on a schedule.

How you do it in Nextcloud today

  1. Open the Shares view in the Files sidebar, which shows files shared with you, by you and by public link in one list.
  2. Spot shared items by the Shared badge, and by the chain-link icon when the share is a public link.
  3. Open each item, check its sharing tab for the link, its password and its expiry date, and look at Others with access for folders shared through a parent.
  4. Click Unshare for each link you no longer want.
  5. The list has no filter for links without a password or an expiry date, so the review is a manual walk through the whole view.

How to audit and remove old public share links in Nextcloud

Prompt

List every public link in my Nextcloud, tell me which have no password or no expiry date, and remove the ones I confirm.
  1. 01

    Collect every link

    The agent asks list_shares for public links only, and pages through them, so a long-forgotten link on a deep sub-folder is not missed.

  2. 02

    Sort by risk

    It puts links with no password and no expiry first, then links with only one of the two, then the rest, and notes folders where people can upload.

  3. 03

    Show what each link points to

    For the risky ones, list_files shows what is inside the folder, so you decide with the file names in front of you rather than a share ID.

  4. 04

    Remove only what you confirm

    remove_share runs for the links you approve, each with your OK by default. The agent never removes a link just because it looks old.

  5. 05

    Keep a log between runs

    On the weekly run, the agent compares the list with last time and reports only new links, so the review stays short.

What you get back

Example data

Public links: 14
No password and no expiry: 2
- /Clients/Acme/proposal-q3.pdf (shared 2026-06-02)
- /Media/press-kit (folder, uploads allowed)
Only missing expiry: 5
Removed after your OK: 2
New since last week: 1

Other ways to ask

  • Every Monday, list public links created in the last 7 days and flag any without a password.
  • Only check the folder /Clients and its sub-folders.
  • Show me which public links allow uploads, and do not remove anything.

What Nextcloud allows, and what to know first

  • A public link on a folder can be set to Read only, Allow upload and editing, or File drop, where visitors can upload but not see what is there.
  • The Shares view shows files shared with you, by you and by a public link in one list, so the agent separates the links by their type.
  • The Share API call GET /shares takes a path, a reshares flag and a subfiles flag, and the subfiles flag on a file instead of a folder returns an error.
  • A share with Set expiration date is disabled by Nextcloud on that date, so links with an expiry need no cleanup.

remove_share asks for your OK by default. To run it weekly without you, switch confirmation off for that tool in your dashboard.

Sources: Nextcloud User Manual: Using the web interface · Nextcloud User Manual: File sharing · Nextcloud Developer Manual: Share API

Call list_shares from a script

curl

curl "https://cotlet.dev/api/v1/nextcloud/shares?path=%2FClients&include_subfiles=true&type=link" \
  -H "Authorization: Bearer $COTLET_API_KEY"

Example response

{
  "shares": [
    {
      "share_id": "412",
      "path": "/Clients/Acme/proposal-q3.pdf",
      "type": "link",
      "url": "https://cloud.example.com/s/Qm4Zr8LcVt1NxWe",
      "permissions": "read",
      "password_protected": false,
      "expires": null,
      "created_at": "2026-06-02T10:11:00Z"
    },
    {
      "share_id": "455",
      "path": "/Clients/Brightly/brief.docx",
      "type": "link",
      "url": "https://cloud.example.com/s/Hd7Pb2YaUs5GkTi",
      "permissions": "read",
      "password_protected": true,
      "expires": "2026-12-01",
      "created_at": "2026-10-09T08:40:00Z"
    }
  ]
}

MCP: add https://cotlet.dev/mcp/v1 with the same key; the call is nextcloud_read → list_shares. Example data.

Schedule it in n8n, Make, Zapier or cron

Nextcloud tools this automation uses

Cotlet Nextcloud tools used to audit and remove old public share links in Nextcloud
Tool Parameters
list_shares path, include_subfiles, type
list_files path
remove_share share_id
All 15 Nextcloud tools with descriptions

Frequently asked questions

Is it safe to connect Nextcloud to Cotlet?

Yes. You sign in to Nextcloud yourself, in your own Cloud Browser in the EU, and we never save your password. Your agents only get Nextcloud once you enable it, every background request is listed, and the browser profile is stored encrypted with AES-256-GCM, the cipher 1Password uses for its vaults. The AI model never sees a login, posts and messages wait for your OK, and Disable for agents cuts access in one click. Independent scanners grade cotlet.dev A+ on Qualys SSL Labs, securityheaders.com and Mozilla Observatory; live results are on https://cotlet.dev/security.

Give your agent access to Nextcloud.

Free 7-day trial with 2,000 credits, no card needed. Cotlet is independent and not affiliated with Nextcloud.

Sign up free