GED — Documents

Stream the document bytes through the backend.

Used by the web frontend instead of presigned URLs because the prod
S3 endpoint (`http://minio:9000`) is not browser-resolvable. The
backend acts as a proxy : auth-checks the user, fetches from S3,
streams to the response with proper Content-Disposition.

L02-03 hardening (audit 2026-05-23) :
- `X-Content-Type-Options: nosniff` empêche les navigateurs de
  sniffer le content (PDF déguisé en HTML/SVG → exécution XSS).
- `Content-Disposition: attachment` forcé pour tous les mimes
  non-whitelistés safe (download dialog plutôt que rendu inline).
  Images (PNG/JPEG/GIF/WebP) + PDF restent `inline` pour permettre
  les aperçus dans le navigateur.

Permissions requises : ged:read

get/api/v1/ged/documents/{document_id}/file

Request

Base URL: https://erp.eyeot.fr/api/v1
URL: https://erp.eyeot.fr/api/v1/api/v1/ged/documents/{document_id}/file
Auth: one of:
- HTTP bearer
- HTTP bearer

Response

Succès — payload {data, meta} (cf. API-GUIDE §3.1)

Changes

No recorded changes to this operation across all 1 revision of this API.