Skip to main content
This is the feature the tool exists for. You and your partner disagree about whose side is wrong. You have a report showing exactly which request was sent, what came back, and which rule of the specification it violates. You send them a link. The argument ends, or it moves on to something substantive.
Returns { "success": true, "data": { "shareToken": "..." } }. The report is then readable, with no authentication, by anyone holding the link that carries that token. Your partner does not need an account. They do not need to sign up, and they do not need to trust our verdict, because the link carries the evidence and not just the conclusion. Minting a link again replaces the previous token, so the old link stops resolving and the new one takes its place. A sandbox report mints a link on any plan, at no cost. A report about your own endpoint needs a current plan to mint one or replace it. A link you already minted keeps working after that plan lapses, and revoking it never needs a plan.

​
What your partner sees

The report, in full: the verdict, each check, the rule it tests, and the request and response that produced it. Nothing about your account travels with it. Credentials tokens are scrubbed where the exchange is captured, before it is stored, so they never reach a report to begin with. The scrub recognises a secret two ways: by field name (the Authorization header, the token field of an OCPI Credentials object, and the other credential-shaped names the specification uses) and by our own cdojo_ and cdpair_ prefixes. The gap, stated rather than implied: a peer that echoes a credential back under a field name nobody predicted defeats both, in the raw form and in the Base64 the header carries from 2.2 on. A conformance run never learns the credentials it authenticated with, so it cannot scrub by value the way the connections view does. Closing that is tracked, and until it is, treat a shared report the way you would treat any artifact built from a partner’s responses.
A shared report is public to anyone holding the token. That is the point, and it is also the caveat: treat the link like the URL of an unlisted document, because that is what it is. When the conversation is over, cut the link off: revoke the token (below), or delete the run (DELETE /api/v1/testing/runs/:id), which kills the link immediately.

​
Why the evidence matters more than the verdict

An engineer told by a vendor’s tool that their OCPI implementation failed conformance has every reason to be skeptical, and should be. An engineer who receives the exact POST that was sent, the 200 OK that came back where the spec requires 405, and the rule requiring it, has something they can act on in the next ten minutes. We built the report to be forwarded, which means it has to survive being read by someone who does not trust us. Delete the share token and the link stops working immediately:
Re-sharing afterwards mints a fresh token; the old link stays dead. Deleting your account revokes every link you minted, and every link on a report you created. Both sets go because any member can mint the one token a report has, so revoking only the links a person minted would leave live links behind. The runs stay with the organisation, and a teammate can mint a fresh link on the same plan terms as any other mint above.