Download the executed PDF

This route does not return JSON on success. It streams the executed PDF itself, proxied through the API while the credential is live: 200 with Content-Type: application/pdf and Content-Disposition: attachment, the filename derived from the original upload with a _signed suffix. There is no redirect and no presigned URL; an earlier version answered with a signed R2 link, and that link kept working after the credential was revoked, which is why the bytes now move only under the live credential.

The evidence that used to share that JSON body rides along as response headers: X-Document-Hash (SHA-256 of the executed PDF) and X-Document-Completed-At.

Ranged requests are supported: a satisfiable Range answers 206 with Content-Range, and an unsatisfiable one answers 416. ETag and Content-Length are set from the stored object.

Only a completed envelope has a downloadable PDF. Every other state (draft, sending, pending, completing, declined, voided, expired), and a completed envelope whose stored key is missing, answers 400 not_completed.

Surprising but deliberate: this operation costs documents:read, not envelopes:read, because it returns document bytes and is priced as a document read.