Shared Record
Give each customer one persistent invoice link for live, independently checkable usage records.
A Shared Record is a stable customer link that can be printed on every invoice:
https://app.pacspace.io/c/{customerHandle}
The link is customer-scoped and persistent. A customer can open it during the invoice cycle, not just after a period closes, and see what has been recorded so far.
What The Customer Sees
The Shared Record keeps the landing page quiet:
- The current period total: "Recorded this period."
- The number of records this cycle.
- A verification line:
Verified through {date}. - Recent records with the same visual treatment whether they are still recording, recorded, or verified.
- Quiet links to all periods, compare, and export.
The customer-facing language is factual. PacSpace records the vendor's attestation and makes that record independently checkable. PacSpace does not act as the meter, grade the customer, or decide whether the invoice should be paid.
Access Code
For the default TWO_TIER policy, the invoice includes:
- The Shared Record link.
- A six-character access code printed next to the link.
Anyone with the link can see the outer summary. Granular activity, exports, PDFs, compare, and timeline details require the access code. Tenants that need a stricter model can choose GATED; tenants that intentionally want a fully open record can choose OPEN.
Live Mid-Cycle Records
The Shared Record reads the same recorded deltas that power receipts and checkpoints. A delta appears in the live view after it is accepted by PacSpace, then moves through the visible states:
recording- accepted but not yet verified.recorded- recorded by the vendor and available in PacSpace.verified- covered by a completed checkpoint.
The link does not create a new customer account or identity graph. It is a capability link scoped to one tenant/customer relationship.
Compatibility With Receipts
Historical receipt links remain valid:
https://app.pacspace.io/receipt/{receiptId}
New invoice bundles may prefer the persistent Shared Record URL once a customer handle exists. Existing integrations that treat verifyUrl as an opaque string continue to work. Integrations that parse the URL should use receipt or checkpoint identifiers from the bundle instead of assuming the URL is always per-period. Machine verification should use verificationApiUrl.
Security Model
Shared Record access has two layers:
- Outer tier: possession of the unguessable
customerHandle. - Inner tier: a host-bound server session issued after the access code or another tenant-selected step-up succeeds.
Sessions are invalidated when a link is revoked, an access code rotates, the access policy changes, or the customer moves to a different branded host.
See also: