diff --git a/js/controllers/website-controller.js b/js/controllers/website-controller.js
index 572d535..f6b77f2 100644
--- a/js/controllers/website-controller.js
+++ b/js/controllers/website-controller.js
@@ -363,7 +363,10 @@ app.controller('websiteCtrl', [
     , path: r.sharePath
     , mode: r.shareMode
     }).then(function (result) {
-      window.alert(JSON.stringify(result));
+      var arr = r.sharedWith || [];
+      arr.push(result.data);
+      r.sharedWith = arr;
+      window.alert(JSON.stringify(result.data));
     });
   };
   vm.Shares.accept = function () {
@@ -377,8 +380,6 @@ app.controller('websiteCtrl', [
   };
   vm.Shares.list = function (r) {
     var pkg = Auth.oauth3.pkg('www@daplie.com');
-    console.log('actual record:');
-    console.log(r);
     return pkg.listShares({
       domain: r.domain
     , hostname: r.domain
@@ -393,6 +394,32 @@ app.controller('websiteCtrl', [
       //r.usersnames = r.sharedWith.map().join(',');
     });
   };
+  vm.Shares.remove = function (r, s) {
+    console.log('Shares.remove');
+    var pkg = Auth.oauth3.pkg('www@daplie.com');
+    return pkg.removeShare({
+      domain: s.domain
+    , hostname: s.domain
+    , tld: s.tld
+    , sld: s.sld
+    //, sub: r.sub
+    , path: s.sharePath
+    , challenge: s.challenge
+    }).then(function (result) {
+      console.log('remove share result:');
+      console.log(result);
+      var index;
+
+      r.sharedWith.forEach(function (_s, i) {
+        if (s.challenge === _s.challenge) {
+          index = i;
+        }
+      });
+
+      r.sharedWith.splice(index, 1);
+      //r.usersnames = r.sharedWith.map().join(',');
+    });
+  };
 
   vm.listSites = function () {
     var sites = [];
diff --git a/js/www@daplie.com.js b/js/www@daplie.com.js
index 8c54092..a46b601 100644
--- a/js/www@daplie.com.js
+++ b/js/www@daplie.com.js
@@ -43,6 +43,21 @@ OAUTH3._pkgs['www@daplie.com'] = {
       return result;
     });
   }
+, removeShare: function (opts) {
+    var providerUri = opts.audience;
+    var session = opts.session;
+
+    // TODO needs a way to have api and assets for audience
+    return OAUTH3.request({
+      method: 'DELETE'
+    , url: OAUTH3.url.normalize(providerUri)
+        + '/api/www@daplie.com/acl/shares/' + (opts.domain || opts.hostname) + '/' + (opts.challenge || opts.token)
+        + '?' + OAUTH3.utils.query.stringify({ tld: opts.tld, sld: opts.sld/*, sub: opts.sub*/, path: opts.path })
+    , session: session
+    }).then(function (result) {
+      return result;
+    });
+  }
 , invite: function (opts) {
     var providerUri = opts.audience;
     var session = opts.session;
diff --git a/templates/website.html b/templates/website.html
index 76e5b2b..8be8a94 100644
--- a/templates/website.html
+++ b/templates/website.html
@@ -226,11 +226,13 @@
               <button class="btn btn-default" ng-click="vm.Sites.contents(r)">List Files</button>
             </td>
             <td ng-bind="r.path">Sites > blogs > blog.jane.smith.net</td>
-            <td><span ng-repeat="share in r.sharedWith" ng-if="!share.me">
+            <td><div ng-repeat="share in r.sharedWith" ng-if="!share.me">
               <span ng-bind="share.path">/</span>
               <span ng-bind="share.comment">friend@email.com</span>
+              <em ng-if="share.pending">pending</em>
               (<span ng-bind="share.mode">rwx</span>)
-            </span></td>
+              <button class="btn btn-link" ng-click="vm.Shares.remove(r, share)">[X]</button>
+            </div></td>
             <td>
               <input type="text" ng-model="r.shareEmail" placeholder="ex: john@example.com" />
               <input type="text" ng-model="r.sharePath" placeholder="/" />