# Read a protected document back, decrypted `GET /documents/{id}/content` **Required scope:** `documents:content` Use it to review a file you did not classify at upload time, for example one a person uploaded through the web app, then describe it with PATCH /documents/{id}/classification. Requires the documents:content scope, which is NOT granted to agent keys by default: an admin adds it deliberately, because it is the difference between a key that can see metadata and one that can read documents. Staged files are not readable here. The connector is hosted, so bytes travel through immut to your model host. ## Parameters | Name | In | Required | Description | |---|---|---|---| | `id` | path | yes | id of the target record | ## Responses | Status | Meaning | |---|---| | `200` | The decrypted file bytes, streamed with its own content type. | | `400` | BadRequest | | `401` | Unauthorized | | `403` | Forbidden | | `429` | RateLimited | ## Example ```bash curl -X GET "https://backend.immut.io/api/v1/documents//content" \ -H "Authorization: Bearer $IMMUT_API_KEY" ``` ## OpenAPI fragment ```json { "/documents/{id}/content": { "get": { "operationId": "getdocumentsidcontent", "summary": "Read a protected document back, decrypted. Use it to review a file you did not classify at upload time, for example one a person uploaded through the web app, then describe it with PATCH /documents/{id}/classification. Requires the documents:content scope, which is NOT granted to agent keys by default: an admin adds it deliberately, because it is the difference between a key that can see metadata and one that can read documents. Staged files are not readable here. The connector is hosted, so bytes travel through immut to your model host.", "description": "Read a protected document back, decrypted. Use it to review a file you did not classify at upload time, for example one a person uploaded through the web app, then describe it with PATCH /documents/{id}/classification. Requires the documents:content scope, which is NOT granted to agent keys by default: an admin adds it deliberately, because it is the difference between a key that can see metadata and one that can read documents. Staged files are not readable here. The connector is hosted, so bytes travel through immut to your model host.", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "id of the target record" } ], "responses": { "200": { "description": "The decrypted file bytes, streamed with its own content type." }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/RateLimited" } }, "tags": [ "Documents" ], "x-required-scope": "documents:content" } } } ```