products/<gtin>/documents/ page
(and its documents/new/, documents/<id>/edit/, documents/<id>/delete/
sub-pages).
When to use
- A brand owner needs to attach a spec sheet, safety data sheet, or other PDF document to a product, or update/remove one already attached.
Auth
X-API-Key header or OAuth token with dashboard:write scope. The caller
must be a member of organization_id and hold the
organization.contribute_organization permission; the product must be owned
by that organization.
Flow
- List — paginated, most-recent first.
- Upload (
multipart/form-data) — a single PDF per request; non-PDF uploads are rejected with422. Page count and thumbnail are extracted asynchronously after upload, so those fields may benullin the immediate response. - Update — metadata only (e.g. title/label), not the file itself; upload a new document and delete the old one to replace the file.
- Delete — removes a single document row;
document_idmust belong to the targeted product.
201 on upload, 403 for a caller without the contribute
permission, 404 for a GTIN/document not owned by organization_id, 422
for a non-PDF upload.
Notes
Writes go through an audited@org_action service, including the
post-upload PDF-processing dispatch — the direct form.save() this
dashboard page used before C-4070 is gone.