Public Access URL Revocation Limits in qTest
19.5K reputation · 27 Jun 2020, 00:27 UTC
Goal
Prevent accidental exposure of test artifacts by revoking or expiring public URLs once the Public Access toggle is disabled.
Current State
Enabling the Public Access toggle creates a permanent read‑only URL that remains valid until the toggle is turned off. However, disabling the toggle does not invalidate URLs that have already been generated; they continue to grant view‑only access until manually deleted. Audit logs record when a public link is created or disabled, but do not track subsequent usage or revocation.
Unresolved Questions
- Does qTest provide an API or UI mechanism to revoke or delete previously generated public URLs after the Public Access toggle has been disabled?
- Can a public URL be configured to expire automatically after a specified period, or must expiration be handled manually?
- Is there a way to enforce revocation of all existing public URLs when a project is moved between environments (e.g., from dev to prod) to avoid cross‑environment leakage?