Documents API

Base paths: /api/orgs/{organizationId}/documents, /api/orgs/{organizationId}/document-folders

All endpoints require Authorization: Bearer <token>.

---

Documents

Upload Document

POST /api/orgs/{organizationId}/documents
Authorization: Bearer <adminToken>
Content-Type: multipart/form-data

file=<binary>
name=Annual Report 2024.pdf
folderId=folder-uuid        (optional)
access=MEMBERS_ONLY

Access levels:

Value	Description
PUBLIC	Anyone with the link
MEMBERS_ONLY	Logged-in organisation members
PRIVATE	Admin only

Response 201:

{
  "id": "doc-uuid",
  "name": "Annual Report 2024.pdf",
  "fileUrl": "https://storage.example.com/orgs/.../annual-report.pdf",
  "fileSize": 2048576,
  "mimeType": "application/pdf",
  "access": "MEMBERS_ONLY",
  "folderId": "folder-uuid",
  "uploadedBy": "user-uuid",
  "createdAt": "2024-06-01T10:00:00Z"
}

---

List Documents

GET /api/orgs/{organizationId}/documents
Authorization: Bearer <token>

Query Parameters:

Param	Type	Description
folderId	UUID	Filter by folder
access	string	PUBLIC, MEMBERS_ONLY, PRIVATE
search	string	Search by name
page	int	Page number
size	int	Page size

---

Get Document

GET /api/orgs/{organizationId}/documents/{docId}
Authorization: Bearer <token>

Returns metadata and a signed download URL valid for a short period.

---

Delete Document

DELETE /api/orgs/{organizationId}/documents/{docId}
Authorization: Bearer <adminToken>

---

Document Folders

Create Folder

POST /api/orgs/{organizationId}/document-folders
Authorization: Bearer <adminToken>

{
  "name": "Policies",
  "parentFolderId": null
}

Supports nested folders via parentFolderId.

---

List Folders

GET /api/orgs/{organizationId}/document-folders
Authorization: Bearer <token>

---

Update Folder

PUT /api/orgs/{organizationId}/document-folders/{folderId}
Authorization: Bearer <adminToken>

---

Delete Folder

DELETE /api/orgs/{organizationId}/document-folders/{folderId}
Authorization: Bearer <adminToken>

caution

Deleting a folder also deletes all documents within it. This action is irreversible.

---

Storage Configuration (Admin)

Get Storage Config

GET /api/admin/storage/config
Authorization: Bearer <systemAdminToken>

---

Update Storage Config

PUT /api/admin/storage/config
Authorization: Bearer <systemAdminToken>

{
  "provider": "gcs",
  "gcsBucketName": "my-bucket",
  "gcsProjectId": "my-project"
}

---

Download File (public with signed URL)

GET /api/storage/{path}

Only accessible if the file is PUBLIC or the URL is a valid signed URL.