Public Access URL Revocation Limits in qTest

Question

GoalPrevent accidental exposure of test artifacts by revoking or expiring public URLs once the Public Access toggle is disabled.Current StateEnabling the Public Access toggle creates a permanent read‑only URL that remains valid until the toggle is turned off. However, disabling the toggle does not invalidate URLs that have already been generated; they continue to grant view‑only access until manually deleted. Audit logs record when a public link is created or disabled, but do not track subsequent usage or revocation.Unresolved QuestionsDoes qTest provide an API or UI mechanism to revoke or delete previously generated public URLs after the Public Access toggle has been disabled?Can a public URL be configured to expire automatically after a specified period, or must expiration be handled manually?Is there a way to enforce revocation of all existing public URLs when a project is moved between environments (e.g., from dev to prod) to avoid cross‑environment leakage?

Tasadduq Burney · Answer

Direct Answer
The most reliable way to revoke existing public URLs in qTest is through the site-level setting that disables public URL serving entirely. This works because qTest validates public links server-side; when public URL serving is disabled, existing links become invalid.

Available Controls
In most qTest versions, you have these practical levers:

Site-level public URL toggle - An administrator setting that, when disabled, invalidates all existing public links across the project
Per-artifact Public Access toggle - Disables new link generation but may not invalidate already-copied URLs depending on version
Manual revocation via API - Enumerate artifacts and clear their public-access flags programmatically

Steps to Implement Revocation

Verify site-level setting - Have an administrator check for a 'public URL serving' or similar toggle in the site configuration
Disable site-level public URL serving - This provides immediate global revocation of all existing public links
Test with existing links - Open a previously generated public URL in an incognito window to confirm it no longer resolves
Consider API automation - For scripted control, use the qTest Manager REST API to enumerate artifacts and clear public-access flags

Important Limitations
No native TTL/expiration - qTest does not provide automatic expiration for public URLs. Any time-based expiration requires manual handling or site-level disable.
Audit logs are informational only - They record creation and toggle changes but do not track link usage or provide revocation capability.
Cross-environment leakage - Moving projects between environments does not invalidate existing public URLs. Revoke them in the source environment first.

Verification Steps

In a test project, enable Public Access, copy the URL, disable the toggle, then attempt to access the URL in a private browser session
Have an administrator disable the site-level public URL setting and retest existing links
Search the qTest REST API documentation for endpoints related to 'public URL', 'share', or 'public access' for your specific version
Contact Tricentis support directly to confirm whether your qTest edition supports server-side URL invalidation

Version and Environment Considerations
Behavior varies between qTest cloud and self-hosted deployments. Site-level controls and API coverage may differ between editions. Always confirm against your exact qTest version's release notes.

Missing Diagnostic Detail
Are these public URLs for qTest Manager artifacts or qTest Insights reports? The available controls and behavior may differ between these two systems.

Public Access URL Revocation Limits in qTest

Goal

Current State

Unresolved Questions

1 answer

Direct Answer

Available Controls

Steps to Implement Revocation

Important Limitations

Verification Steps

Version and Environment Considerations

Missing Diagnostic Detail

Your perspective belongs here.

1 question comment