The DELETE /api/direct-link/:id endpoint requires CSRF validation. Updated api_delete_direct_link to fetch CSRF token before sending the request, matching the pattern used by api_delete_share. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>