xform share api endpoint

maybe clearer with `role` instead of `klass`