The document itself: the bytes this booking rests on, verified against their hash
const url = 'https://example.com/v1/entities/example/documents/example/content?disposition=attachment';const options = {method: 'GET'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://example.com/v1/entities/example/documents/example/content?disposition=attachment'Return the document’s bytes, verified against the registered hash (issue 0007, acceptance criterion 3).
The bytes come only from under the configured blob_root; a blob_path is caller-supplied, so without
that containment it would be a file-read primitive. They are hashed before any byte is returned, and
inline is honoured only for media types that cannot execute. A refusal never names a filesystem path,
not even when the file is simply missing.
There is no finer authorization than the entity scoping every route already has. Haddon records authority
and does not enforce it (decisions.md, “Authorisation”). A credential reaches this route only for an
entity it is scoped to, and an id from another entity’s file is a plain 404 like any other.
Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”The entity this path is relative to
The entity this path is relative to
Query Parameters
Section titled “Query Parameters”Inline is honoured only for media types that cannot execute; everything else downloads
Inline is honoured only for media types that cannot execute; everything else downloads
Responses
Section titled “Responses”The registered bytes, verified against the registered hash
Bad Request
object
Example generated
{ "error": { "code": "example", "message": "example", "retryable": true, "details": [ {} ], "request_id": "example", "next_action": {} }}Unauthorized
object
Example generated
{ "error": { "code": "example", "message": "example", "retryable": true, "details": [ {} ], "request_id": "example", "next_action": {} }}Forbidden
object
Example generated
{ "error": { "code": "example", "message": "example", "retryable": true, "details": [ {} ], "request_id": "example", "next_action": {} }}Not Found
object
Example generated
{ "error": { "code": "example", "message": "example", "retryable": true, "details": [ {} ], "request_id": "example", "next_action": {} }}Conflict
object
Example generated
{ "error": { "code": "example", "message": "example", "retryable": true, "details": [ {} ], "request_id": "example", "next_action": {} }}Precondition Failed
object
Example generated
{ "error": { "code": "example", "message": "example", "retryable": true, "details": [ {} ], "request_id": "example", "next_action": {} }}Unprocessable Content
object
Example generated
{ "error": { "code": "example", "message": "example", "retryable": true, "details": [ {} ], "request_id": "example", "next_action": {} }}Internal Server Error
object
Example generated
{ "error": { "code": "example", "message": "example", "retryable": true, "details": [ {} ], "request_id": "example", "next_action": {} }}Service Unavailable
object
Example generated
{ "error": { "code": "example", "message": "example", "retryable": true, "details": [ {} ], "request_id": "example", "next_action": {} }}