E166: List documents for an entity
GET /api/documents?entityType=&entityId=
Returns the attachments of one parent entity, newest first. Both query params are required — a bare GET /documents would otherwise be an unbounded cross-entity scan.
Authentication
Standard tenant route. Requires Authorization: Bearer <firebase-id-token> and X-Org-Id: <org-id>. Access: Member.
Request
Query params: entityType (purchase_order | work_order | sales_order) and entityId (uuid).
Response — 200 OK
{ "data": [ Document ], "nextCursor": null }
An unknown parent yields an empty list (the org-scoped query simply matches nothing).
Errors
| HTTP | code | Condition |
|---|---|---|
| 422 | validation_failed | Missing/invalid entityType or entityId. |