[Cotlet](https://cotlet.dev/index.md) · [Integrations](https://cotlet.dev/integrations.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Use cases](https://cotlet.dev/use-cases.md) · [Security](https://cotlet.dev/security.md) · [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md) · [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [Contact](https://cotlet.dev/contact.md) · [Pricing](https://cotlet.dev/pricing.md) · [Sign up](https://cotlet.dev/signup)

# Audit and remove old public share links in Nextcloud

> List every public link in your Nextcloud, flag links with no password or expiry and remove the ones you approve, on a weekly schedule.

Source: https://cotlet.dev/integrations/nextcloud-api-mcp-server/audit-public-share-links

Public links pile up in a Nextcloud over months, and nobody remembers which folder is still open to anyone who has the URL.

Cotlet does it in your own Nextcloud account with list\_shares, list\_files and remove\_share, called by your AI agent, an n8n workflow or a script.

[Sign up free](https://cotlet.dev/app/signup?app=nextcloud) [All Nextcloud tools](https://cotlet.dev/integrations/nextcloud-api-mcp-server.md)

Hosted · nothing to install or maintain

## Can Nextcloud do this on its own?

Nextcloud has the Shares view in the UI and GET /shares in the Share API, which lists all shares of a user and can narrow them by path (checked 16 Oct 2026). Neither flags a missing password or expiry, and nothing runs the review for you on a schedule.

## How you do it in Nextcloud today

1. Open the Shares view in the Files sidebar, which shows files shared with you, by you and by public link in one list.
2. Spot shared items by the Shared badge, and by the chain-link icon when the share is a public link.
3. Open each item, check its sharing tab for the link, its password and its expiry date, and look at Others with access for folders shared through a parent.
4. Click Unshare for each link you no longer want.
5. The list has no filter for links without a password or an expiry date, so the review is a manual walk through the whole view.

## How to audit and remove old public share links in Nextcloud

Prompt

```
List every public link in my Nextcloud, tell me which have no password or no expiry date, and remove the ones I confirm.
```

1. 01  
### Collect every link  
The agent asks list\_shares for public links only, and pages through them, so a long-forgotten link on a deep sub-folder is not missed.
2. 02  
### Sort by risk  
It puts links with no password and no expiry first, then links with only one of the two, then the rest, and notes folders where people can upload.
3. 03  
### Show what each link points to  
For the risky ones, list\_files shows what is inside the folder, so you decide with the file names in front of you rather than a share ID.
4. 04  
### Remove only what you confirm  
remove\_share runs for the links you approve, each with your OK by default. The agent never removes a link just because it looks old.
5. 05  
### Keep a log between runs  
On the weekly run, the agent compares the list with last time and reports only new links, so the review stays short.

### What you get back

Example data

```
Public links: 14
No password and no expiry: 2
- /Clients/Acme/proposal-q3.pdf (shared 2026-06-02)
- /Media/press-kit (folder, uploads allowed)
Only missing expiry: 5
Removed after your OK: 2
New since last week: 1
```

### Other ways to ask

- Every Monday, list public links created in the last 7 days and flag any without a password.
- Only check the folder /Clients and its sub-folders.
- Show me which public links allow uploads, and do not remove anything.

## What Nextcloud allows, and what to know first

- A public link on a folder can be set to Read only, Allow upload and editing, or File drop, where visitors can upload but not see what is there.
- The Shares view shows files shared with you, by you and by a public link in one list, so the agent separates the links by their type.
- The Share API call GET /shares takes a path, a reshares flag and a subfiles flag, and the subfiles flag on a file instead of a folder returns an error.
- A share with Set expiration date is disabled by Nextcloud on that date, so links with an expiry need no cleanup.

remove\_share asks for your OK by default. To run it weekly without you, switch confirmation off for that tool in your dashboard.

Sources: [Nextcloud User Manual: Using the web interface](https://docs.nextcloud.com/server/stable/user%5Fmanual/en/files/access%5Fwebgui.html) · [Nextcloud User Manual: File sharing](https://docs.nextcloud.com/server/stable/user%5Fmanual/en/files/sharing.html) · [Nextcloud Developer Manual: Share API](https://docs.nextcloud.com/server/stable/developer%5Fmanual/client%5Fapis/OCS/ocs-share-api.html)

## Call list\_shares from a script

curl

```
curl "https://cotlet.dev/api/v1/nextcloud/shares?path=%2FClients&include_subfiles=true&type=link" \
  -H "Authorization: Bearer $COTLET_API_KEY"
```

Example response

```
{
"shares": [
{
"share_id": "412",
"path": "/Clients/Acme/proposal-q3.pdf",
"type": "link",
"url": "https://cloud.example.com/s/Qm4Zr8LcVt1NxWe",
"permissions": "read",
"password_protected": false,
"expires": null,
"created_at": "2026-06-02T10:11:00Z"
},
{
"share_id": "455",
"path": "/Clients/Brightly/brief.docx",
"type": "link",
"url": "https://cloud.example.com/s/Hd7Pb2YaUs5GkTi",
"permissions": "read",
"password_protected": true,
"expires": "2026-12-01",
"created_at": "2026-10-09T08:40:00Z"
}
]
}
```

MCP: add https://cotlet.dev/mcp/v1 with the same key; the call is nextcloud\_read → list\_shares. Example data.

[Schedule it in n8n, Make, Zapier or cron](https://cotlet.dev/integrations/nextcloud-api-mcp-server.md#automations)

## Nextcloud tools this automation uses

__Cotlet Nextcloud tools used to audit and remove old public share links in Nextcloud__
| Tool | Parameters |
| ------------- | ----------------------------- |
| list\_shares | path, include\_subfiles, type |
| list\_files | path |
| remove\_share | share\_id |

[All 15 Nextcloud tools with descriptions](https://cotlet.dev/integrations/nextcloud-api-mcp-server.md#tools)

## Frequently asked questions

### Is it safe to connect Nextcloud to Cotlet?

Yes. You sign in to Nextcloud yourself, in your own Cloud Browser in the EU, and we never save your password. Your agents only get Nextcloud once you enable it, every background request is listed, and the browser profile is stored encrypted with AES-256-GCM, the cipher 1Password uses for its vaults. The AI model never sees a login, posts and messages wait for your OK, and Disable for agents cuts access in one click. Independent scanners grade cotlet.dev A+ on Qualys SSL Labs, securityheaders.com and Mozilla Observatory; live results are on https://cotlet.dev/security.

## More Nextcloud automations

- [Share a Nextcloud file with an expiring, password-protected link](https://cotlet.dev/integrations/nextcloud-api-mcp-server/share-file-with-expiring-link.md)
- [Create Nextcloud Deck cards from meeting notes](https://cotlet.dev/integrations/nextcloud-api-mcp-server/create-deck-cards-from-notes.md)
- [Nextcloud API and MCP server: every tool](https://cotlet.dev/integrations/nextcloud-api-mcp-server.md)
- [All use cases](https://cotlet.dev/use-cases.md)

## Give your agent access to Nextcloud.

Free 7-day trial with 2,000 credits, no card needed. Cotlet is independent and not affiliated with Nextcloud.

[Sign up free](https://cotlet.dev/app/signup?app=nextcloud)

---

Give your AI agents your signed-in browser.

**Product:** [Integrations](https://cotlet.dev/integrations.md) · [Use cases](https://cotlet.dev/use-cases.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Pricing](https://cotlet.dev/pricing.md) · [Security](https://cotlet.dev/security.md)

**Resources:** [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [GitHub](https://github.com/cotletdev/cotlet)

**Solutions:** [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md)

**Company:** [About](https://cotlet.dev/about.md) · [AI info: company facts](https://cotlet.dev/ai-info.md) · [Contact](https://cotlet.dev/contact.md)

**Legal:** [Terms of service](https://cotlet.dev/terms) · [Privacy policy](https://cotlet.dev/privacy) · [Refund policy](https://cotlet.dev/refunds) · [Acceptable use](https://cotlet.dev/acceptable-use) · [Cookie policy](https://cotlet.dev/cookies) · [DPA](https://cotlet.dev/dpa) · [Subprocessors](https://cotlet.dev/subprocessors)

**Elsewhere:** [Status page](https://status.cotlet.dev) · [Cotlet on GitHub](https://github.com/cotletdev) · [Cotlet on X](https://x.com/cotletdev) · [Cotlet on LinkedIn](https://www.linkedin.com/company/cotletdev) · [Cotlet on Product Hunt](https://www.producthunt.com/products/cotlet) · [Cotlet on Crunchbase](https://www.crunchbase.com/organization/cotlet) · [Cotlet on SaaSHub](https://www.saashub.com/cotlet)

Cotlet is an independent service. It is not affiliated with, endorsed by or sponsored by any of the products listed on this site. Product names are trademarks of their respective owners.

## For AI agents: sign your user up

Is your user asking you to sign them up for Cotlet? You can do it for them, no account or key needed.

1. Read the fields and their allowed values: GET https://cotlet.dev/api/v1/access-requests
2. Ask the user for each value: email, apps, what you will do with them. If they leave the password to you, generate a strong one and show it to them.
3. Show the user what you will send, then POST it as JSON to https://cotlet.dev/api/v1/access-requests.

One call creates the account and sends the access request; we email the user when access is granted.