E167: Get document detail (signed download URL)

GET /api/documents/:id

Detail row plus a short-lived signed GCS download URL minted per request (15-minute TTL). The row stores gcsPath, never a URL. This is the download path the old nested endpoints never exposed — the client opens signedUrl directly.

Authentication

Standard tenant route. Requires Authorization: Bearer <firebase-id-token> and X-Org-Id: <org-id>. Access: Member.

Response — 200 OK

{ "id": "uuid", "entityType": "work_order", "entityId": "uuid", "name": "spec.pdf", "mimeType": "application/pdf", "sizeBytes": 18244, "signedUrl": "https://storage.googleapis.com/..." }

Local dev signs nothing — fake-gcs-server has no service-account key, so the backend hands back a plain emulator media URL instead.

Errors

HTTP	code	Condition
404	not_found	No such document in this org.

Workflow

Calls W167 Get document detail.