> ## Documentation Index
> Fetch the complete documentation index at: https://docs.artosai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Stream a Document Session

> Streams document bytes for a viewer using a short-lived session token sent in the Authorization header. A session token in the query string is rejected for ordinary downloads; the query form is reserved for the OnlyOffice server-to-server flow and requires a separate signed OnlyOffice JWT. This route does not accept S3 URLs or raw object keys.



## OpenAPI

````yaml /api-reference/openapi-v1.json get /open-document
openapi: 3.0.0
info:
  title: Artos API
  description: API for document generation, template management, and document organization
  version: 1.0.0
  contact:
    name: Artos Support
    email: internal@artosai.com
servers:
  - url: https://api.artosai.com
    description: Production server
  - url: http://localhost:8000
    description: Local development server
security:
  - bearerAuth: []
paths:
  /open-document:
    get:
      tags:
        - Files
      summary: Stream a Document Session
      description: >-
        Streams document bytes for a viewer using a short-lived session token
        sent in the Authorization header. A session token in the query string is
        rejected for ordinary downloads; the query form is reserved for the
        OnlyOffice server-to-server flow and requires a separate signed
        OnlyOffice JWT. This route does not accept S3 URLs or raw object keys.
      operationId: openDocument
      parameters:
        - name: session_token
          in: query
          required: false
          schema:
            type: string
          description: >-
            OnlyOffice compatibility parameter. Do not use this query parameter
            for ordinary downloads; send the session token as Authorization:
            Bearer instead.
      responses:
        '200':
          description: Document stream
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '401':
          description: Missing, invalid, expired, or revoked session token
        '500':
          description: Unable to retrieve document
      security:
        - documentSessionAuth: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Okta access-token JWT sent as a Bearer token. The token identifies the
        user and scopes access to the user's organization.
    documentSessionAuth:
      type: http
      scheme: bearer
      description: >-
        Short-lived document session token sent in the Authorization header. Do
        not put this credential in a URL.

````