diff --git a/changelog/unreleased/enhancement-sharing-ng.md b/changelog/unreleased/enhancement-sharing-ng.md
index 6edd0dd0902..542c644950c 100644
--- a/changelog/unreleased/enhancement-sharing-ng.md
+++ b/changelog/unreleased/enhancement-sharing-ng.md
@@ -7,12 +7,14 @@ The following endpoints are added:
 * /v1beta1/me/drive/sharedWithMe
 * /v1beta1/roleManagement/permissions/roleDefinitions
 * /v1beta1/roleManagement/permissions/roleDefinitions/{roleID}
+* /v1beta1/drives/{drive-id}/items/{item-id}/createLink (create a sharing link)
 
 https://github.com/owncloud/ocis/pull/7633
 https://github.com/owncloud/ocis/pull/7686
 https://github.com/owncloud/ocis/pull/7684
 https://github.com/owncloud/ocis/pull/7683
 https://github.com/owncloud/ocis/pull/7239
+https://github.com/owncloud/ocis/pull/7687
 https://github.com/owncloud/libre-graph-api/pull/112
 https://github.com/owncloud/ocis/issues/7436
 https://github.com/owncloud/ocis/issues/6993
diff --git a/services/graph/pkg/service/v0/driveitems.go b/services/graph/pkg/service/v0/driveitems.go
index f8028bc711a..c1ea69707bc 100644
--- a/services/graph/pkg/service/v0/driveitems.go
+++ b/services/graph/pkg/service/v0/driveitems.go
@@ -20,9 +20,10 @@ import (
 	"github.com/cs3org/reva/v2/pkg/utils"
 	"github.com/go-chi/render"
 	libregraph "github.com/owncloud/libre-graph-api-go"
+	"golang.org/x/crypto/sha3"
+
 	"github.com/owncloud/ocis/v2/ocis-pkg/log"
 	"github.com/owncloud/ocis/v2/services/graph/pkg/service/v0/errorcode"
-	"golang.org/x/crypto/sha3"
 )
 
 // GetRootDriveChildren implements the Service interface.
@@ -234,6 +235,56 @@ func (g Graph) GetDriveItemChildren(w http.ResponseWriter, r *http.Request) {
 	render.JSON(w, r, &ListResponse{Value: files})
 }
 
+// Invite invites a user to a storage drive (space).
+func (g Graph) Invite(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	driveID, err := storagespace.ParseID(chi.URLParam(r, "driveID"))
+	if err != nil {
+		errorcode.RenderError(w, r, errorcode.New(errorcode.InvalidRequest, err.Error()))
+		return
+	}
+
+	driveItemID, err := storagespace.ParseID(chi.URLParam(r, "driveItemID"))
+	if err != nil {
+		errorcode.RenderError(w, r, errorcode.New(errorcode.InvalidRequest, err.Error()))
+		return
+	}
+
+	if driveID.StorageId != driveItemID.StorageId || driveID.SpaceId != driveItemID.SpaceId {
+		errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, "Item does not exist")
+		return
+	}
+
+	gatewayClient, err := g.gatewaySelector.Next()
+	if err != nil {
+		errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	statResponse, err := gatewayClient.Stat(ctx, &storageprovider.StatRequest{Ref: &storageprovider.Reference{ResourceId: &driveItemID}})
+	if err != nil {
+		errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, err.Error())
+		return
+	}
+	switch statResponse.Status.Code {
+	case cs3rpc.Code_CODE_OK:
+		// ok
+	case cs3rpc.Code_CODE_NOT_FOUND:
+		errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, statResponse.Status.Message)
+		return
+	case cs3rpc.Code_CODE_PERMISSION_DENIED:
+		errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, statResponse.Status.Message) // do not leak existence? check what graph does
+		return
+	case cs3rpc.Code_CODE_UNAUTHENTICATED:
+		errorcode.Unauthenticated.Render(w, r, http.StatusUnauthorized, statResponse.Status.Message) // do not leak existence? check what graph does
+		return
+	default:
+		errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, statResponse.Status.Message)
+		return
+	}
+}
+
 func (g Graph) getDriveItem(ctx context.Context, ref storageprovider.Reference) (*libregraph.DriveItem, error) {
 	gatewayClient, err := g.gatewaySelector.Next()
 	if err != nil {
diff --git a/services/graph/pkg/service/v0/service.go b/services/graph/pkg/service/v0/service.go
index a02a25d62ca..deb5c6eb776 100644
--- a/services/graph/pkg/service/v0/service.go
+++ b/services/graph/pkg/service/v0/service.go
@@ -107,6 +107,8 @@ type Service interface {
 	GetDriveItem(w http.ResponseWriter, r *http.Request)
 	GetDriveItemChildren(w http.ResponseWriter, r *http.Request)
 
+	Invite(w http.ResponseWriter, r *http.Request)
+
 	GetTags(w http.ResponseWriter, r *http.Request)
 	AssignTags(w http.ResponseWriter, r *http.Request)
 	UnassignTags(w http.ResponseWriter, r *http.Request)
@@ -194,6 +196,7 @@ func NewService(opts ...Option) (Graph, error) {
 		r.Route("/v1beta1", func(r chi.Router) {
 			r.Get("/me/drive/sharedByMe", svc.GetSharedByMe)
 			r.Get("/me/drive/sharedWithMe", svc.ListSharedWithMe)
+			r.Get("/drives/{driveID}/items/{driveItemID}/createLink", svc.Invite)
 			r.Route("/roleManagement/permissions/roleDefinitions", func(r chi.Router) {
 				r.Get("/", svc.GetRoleDefinitions)
 				r.Get("/{roleID}", svc.GetRoleDefinition)