Download one of this contact's CRM documents
GET/api/contacts/:contact/crm/document
The bytes of a document the CRM holds for this person — an offer's PDF, or a file uploaded onto their record where the provider can serve one.
The reference is verified against this contact's own linked record
before anything is fetched. A document id is an opaque string in a
query parameter, and an endpoint that served whatever it was handed
would be an enumeration hole into a clinic's patient files. Only refs
that appear in this contact's own section=documents list with
downloadable: true are served.
"Not found" and "not yours" answer identically (404), so nothing about what the clinic holds can be learnt from the shape of a refusal either. A budget refusal or a provider outage answers 503 with a machine key.
The response is always an attachment with X-Content-Type-Options: nosniff and Cache-Control: private, no-store: a clinic's uploaded
file is untrusted content, and served inline an HTML file masquerading
as a document would run on our own origin. The bytes are never stored
and never logged.
Costs two reads out of the tenant's allowance — one to verify, one to
fetch — which is why it is a button rather than something a screen does
on load. Requires Contact view.
Request
Responses
- 200
- 401
- 403
- 404
- 503
The document.
Response Headers
Always attachment, with a conservatively sanitized filename.
Not authenticated. code: account_disabled means the member's seat was deactivated in this workspace: the session is over even though the token was not revoked (clients sign out and clean up).
Authenticated but not allowed.
No such document for this contact — which also covers a document that exists and belongs to somebody else.
The read was refused by the budget, or the CRM could not be reached.