List a product's evidence documents

GET 
/api/v1/products/:id/documents

Required scope: dpp:read. Returns each document's metadata including fileSha256 (integrity) and verificationStatus (verifier progress). Cross-tenant / unknown id returns 404. Use GET /documents/{id}/download for a signed URL to the file.

Uploaded files are scanned for malware only on a deployment whose scanner is configured. virusScanStatus is set to Pending when a document is uploaded and stays Pending where no scanner is configured. Pending and ScanFailed are not malware verdicts. Clean is recorded only when the scanned bytes match fileSha256. A document marked Infected has its file removed and cannot be downloaded.

Request

Responses

200

Documents

403

403 — missing scope (FORBIDDEN_SCOPE) or module (FORBIDDEN_MODULE).

404

404 — not found OR owned by another tenant (NOT_FOUND; IDOR-safe).

429

429 — RATE_LIMITED (per-key limit, reads and writes alike; fails closed, so a limiter outage also returns 429). A limiter-down 429 is deliberately indistinguishable from a quota 429. Carries Retry-After (seconds).

Response Headers

Retry-After

Seconds to wait before retrying (429 only).

RateLimit-Limit

Per-minute request ceiling for this key's tier.

RateLimit-Remaining

Requests left in the current window (floored at 0).

RateLimit-Reset

Seconds until the window resets.

503

503 — the API is not enabled on this environment (FEATURE_DISABLED).