Stream one artifact
The bytes come from apps/artifact-worker, which re-verifies the SHA-256 and the byte size of what it reads before any of it reaches the caller. The object key never leaves the server. Use versions/{representationId} as the kind to fetch a specific PDF render.
The bytes come from apps/artifact-worker, which re-verifies the SHA-256 and the byte size of what it reads before any of it reaches the caller. The object key never leaves the server. Use versions/{representationId} as the kind to fetch a specific PDF render.
Authorization
consoleSession Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.
In: cookie
Path Parameters
uuiduuidA public artifact kind (signed-xml, submission-zip, cdr-zip, cdr-xml, pdf-a4, pdf-ticket, qr-png), or versions/{representationId} for a specific PDF render.
Response Body
application/octet-stream
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/console/v1/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/documents/497f6eca-6276-4993-bfeb-53cbbbba6f08/artifacts/string" \ -H "Authorization: Bearer apf_v2_tu_credencial"Everything the platform produced for one comprobante GET GET
Previous Page
The API credentials of this company GET GET
Any member may read it, VIEWER included. It carries no secret -- there is no column holding one -- and the public prefix it does carry is already reported for every operation by GET /console/v1/companies/{companyId}/activity, so hiding this list would be a rule with no content. Revoked and expired credentials stay in it.