Get Sign document metadata

Get metadata for an uploaded signing document: title, content type, size, original and signing-PDF SHA-256, version and predecessor, page count and page sizes, and upload provenance. The bytes are downloaded separately.

Outcome

Before you start

Verify the environment, authenticated identity and specifically approved organization context.
The published application permission is workspace:read. Resolve and bind the exact canonical Sign workspace. A supplied id or organization membership alone grants no workspace access.
Session callers require read workspace access. API-key resource binding is verified by Auth; never treat a caller-supplied header as an independent grant.

Discover the target

topolo whoami --json
topolo actions get app_topolo_sign.documents.get --detail --json
topolo resources topolo-sign --json
topolo workspaces list topolo-sign --json

Set SIGN_WORKSPACE_ID to the exact granted workspace returned by discovery.
Discover documentId and documentRef from upload or authorized retained metadata; they are distinct identifiers.

Request

GET /api/documents/{documentId}

Inspect and test this action. Save the reviewed input as payload.json. Supply resource context separately.

Input fields

Field	Required	Meaning	Constraints
`documentId`	Required	Exact document.id returned by upload or retained metadata. This is different from documentRef.	{"minLength":1}

Read the complete input schema.

Effects

Get metadata for an uploaded signing document: title, content type, size, original and signing-PDF SHA-256, version and predecessor, page count and page sizes, and upload provenance. The bytes are downloaded separately.

Interpret the response

Read $.document.id for the returned document identifier. An empty collection does not discover a target.

Compare document.id and document.documentRef to the exact retained upload in this workspace. Retain sha256Hex for original content and pdfSha256 for the signing PDF, and inspect ingestionStatus, pageCount/pages, version, previousVersionId and provenance. Use documents.content.get or documents.pdf.get for bytes; Base64-decode and hash those bytes against the appropriate retained SHA-256.

Inspect the success schema. CLI/MCP add their transport envelope; --detail requests the full CLI result. HTTP 204 contains no JSON payload.

Worked examples

Captured from the exported Sign Worker with the existing SQLite-backed D1 harness applying all core, envelope and audit migrations to one local database, in-memory R2 and synthetic Auth/workspace/archive/Notify transports. These examples prove local validation, persistence and artifact production. They do not prove separate deployed D1 topology, real recipient consent, provider delivery or a live signed agreement. All identities, signing links and documents are synthetic; replace identifiers through authorized discovery and never execute a fixture against a live organization. Binary download examples use the released SDK binary projection; tests Base64-decode and compare original bytes, lengths and server SHA-256 headers.

Supported request · Read exact uploaded metadata, source hash and page geometry

Input · payload.json:

{
  "documentId": "92c3741e-171c-439c-9419-597ffe485224"
}

CLI:

topolo actions validate app_topolo_sign.documents.get --data @payload.json --json
topolo actions plan app_topolo_sign.documents.get --resource-type workspace --resource-id "$SIGN_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_sign.documents.get --resource-type workspace --resource-id "$SIGN_WORKSPACE_ID" --data @payload.json --detail --json

MCP tool and arguments:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_sign.documents.get",
    "input": {
      "documentId": "92c3741e-171c-439c-9419-597ffe485224"
    },
    "resourceType": "workspace",
    "resourceId": "<exact granted id from discovery>",
    "detail": true
  }
}

Captured exported Worker response · HTTP 200:

{
  "document": {
    "id": "92c3741e-171c-439c-9419-597ffe485224",
    "documentRef": "sign-document:92c3741e-171c-439c-9419-597ffe485224",
    "documentTitle": "Fixture agreement",
    "fileName": "Fixture-agreement.pdf",
    "contentType": "application/pdf",
    "sizeBytes": 861,
    "sha256Hex": "bc75a1b1ad4d41a275e3a4dadd9a6031e0c56029e486e47a181ba84891acc97f",
    "version": 1,
    "previousVersionId": null,
    "ingestionStatus": "ready",
    "pdfSha256": "bc75a1b1ad4d41a275e3a4dadd9a6031e0c56029e486e47a181ba84891acc97f",
    "pageCount": 1,
    "pages": [
      {
        "width": 612,
        "height": 792
      }
    ],
    "provenance": {
      "ingestor": "topolo-sign-ingest/2",
      "channel": "inline-base64",
      "uploadedByUserId": "usr_sign_fixture",
      "uploadedByEmail": "operator@example.test",
      "clientFileName": "Fixture agreement.pdf",
      "declaredContentType": "application/pdf",
      "detectedContentType": "application/pdf",
      "normalizedToPdf": false,
      "pdfVersion": "1.7",
      "previousVersionId": null,
      "previousSha256": null,
      "requestId": "bb3be417-ae54-41fe-82d6-bef90d5164d6",
      "ingestedAt": "2026-10-05T18:07:40.431Z"
    },
    "contentUrl": "/api/documents/92c3741e-171c-439c-9419-597ffe485224/content",
    "pdfUrl": "/api/documents/92c3741e-171c-439c-9419-597ffe485224/pdf",
    "createdByEmail": "operator@example.test",
    "createdAt": "2026-10-05T18:07:40.431Z",
    "updatedAt": "2026-10-05T18:07:40.431Z"
  }
}

HTTP 200. Compare document.id and document.documentRef to the exact retained upload in this workspace. Retain sha256Hex for original content and pdfSha256 for the signing PDF, and inspect ingestionStatus, pageCount/pages, version, previousVersionId and provenance. Use documents.content.get or documents.pdf.get for bytes; Base64-decode and hash those bytes against the appropriate retained SHA-256.

Refused request · HTTP 401

Input · payload.json:

{
  "documentId": "3314b7c7-66d1-4b67-83ca-b359421163a5"
}

CLI:

topolo actions validate app_topolo_sign.documents.get --data @payload.json --json
topolo actions plan app_topolo_sign.documents.get --resource-type workspace --resource-id "$SIGN_WORKSPACE_ID" --data @payload.json --json

Captured exported Worker response · HTTP 401:

{
  "error": "Token validation failed"
}

HTTP 401. Resolve the exact refusal before retrying. This request is not a successful workflow.

Verify the result

Compare document.id and document.documentRef to the exact retained upload in this workspace.
Retain sha256Hex for original content and pdfSha256 for the signing PDF, and inspect ingestionStatus, pageCount/pages, version, previousVersionId and provenance.
Use documents.content.get or documents.pdf.get for bytes; Base64-decode and hash those bytes against the appropriate retained SHA-256.

Errors and recovery

document_not_found (HTTP 404): Resolve document.id from the retained authorized upload; documentRef is a different identifier.
auth_error (HTTP 401): Reauthenticate in the same approved context before retrying.

Some existing refusals return a human message as error rather than a stable code; preserve the actual response, status and request id. Platform validation, authentication and resource checks can refuse before the handler.

Recovery boundary

This read changes no organizer data. Resolve identity, permission, resource binding or target state and repeat the same reviewed read. Do not turn a refused read into a mutation.