Build governed PDF workflows with confidence.

Search the seven native Studio bridge contracts below. Select an operation to review its behavior, prerequisites and release controls. These are documentation references, not live API calls.

ERP-connected requests are designed for authenticated same-origin sessions with verified identity. Cookie-based mutations must include the application-approved CSRF token and use same-origin credentials. Cross-origin Cloud and machine-to-machine access must use a separately certified authorization profile; reusing a browser cookie for cross-origin access is not a supported shortcut.

const response = await fetch(
  '/api/docsphere360/v2/documents/' + encodeURIComponent(documentId) + '/studio/session',
  { method: 'GET', credentials: 'same-origin',
    headers: { Accept: 'application/json' } }
);
if (!response.ok) throw new Error('Studio session unavailable: ' + response.status);
const session = await response.json();
// Honor session.permissions and session.editor.engine_bound.
// Never infer edit permission from a successful PDF preview.

{
  "product": "docusphere360-pdf-studio",
  "repository": "docsphere360",
  "storage_mode": "canonical_document_versions",
  "document": {
    "id": "00000000-0000-4000-8000-000000000001",
    "mime_type": "application/pdf",
    "current_version": { "id": "00000000-0000-4000-8000-000000000002",
      "content_sha256": "<64-character-sha256>" }
  },
  "permissions": {
    "read": true,
    "recover_draft": false,
    "save_revision": false
  },
  "editor": { "engine_bound": false, "mode": "preview_and_versioned_revision" },
  "recovery": { "scope": "<opaque-recovery-scope>",
    "draft_sync_enabled": false,
    "draft_endpoint": "/api/docsphere360/v2/documents/{id}/studio/draft"
  },
  "urls": { "preview": ".../studio/preview", "comments": ".../studio/comments",
    "save": ".../studio/save", "versions": ".../versions",
    "download": ".../download" }
}

Do not synthesize server capability booleans. When editor.engine_bound or permissions.save_revision is false, offer preview/review only. When draft_sync_enabled is false, do not indicate that a local checkpoint has been synchronized to the server.

GET .../studio/preview returns same-origin PDF bytes with Content-Type: application/pdf, X-Content-SHA256, Cache-Control: private, no-store and frame restrictions. The optional version_id must be an authorized version belonging to the same document.

GET .../studio/comments reads up to 100 non-deleted annotations within the resolved tenant. The source returns comments with identifiers, version/page references, text, state, creator and timestamp. Read access does not confer write permission.

When separately certified and enabled, POST .../studio/save requires a multipart PDF file (maximum 64 MiB in the candidate controller) plus base_version_id and a 64-character base_sha256. An optional version_label is limited to 64 characters.

file: <binary application/pdf>
base_version_id: <UUID of the current PDF version>
base_sha256: <64 hex characters of the current bytes>
version_label: "Reviewed changes"  # optional

If the authoritative PDF changed since the client opened it, the service returns 409 PDF_STUDIO_VERSION_CONFLICT. If revision-write or native-editor certification gates are disabled, it returns 503 PDF_STUDIO_REVISION_GATE_HOLD. A successful authorized write creates a new canonical version; it does not overwrite prior history.

The three .../studio/draft operations use a tenant/user/document-scoped server record. The server draft is encrypted at rest and remains separate from the approved PDF version. The source controller refuses all draft operations until the sync flag is enabled and the recovery migration is installed.

{
  "schema": 1,
  "base_version_id": "00000000-0000-4000-8000-000000000002",
  "base_sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
  "note": "Review these figures before publishing",
  "operations": [],
  "updated_at": 1790000000000,
  "generation": 1,
  "expected_generation": 0
}

Server drafts in the candidate are configured for 30-day expiry by default; governed purge procedures are still subject to release approval. A stale base revision returns 409 RECOVERY_BASE_VERSION_CONFLICT; concurrent generation returns 409 RECOVERY_GENERATION_CONFLICT; oversized data returns 413; the disabled release gate returns 503 RECOVERY_SYNC_GATE_HOLD.

Clients should retain safe request identifiers, status codes and redacted diagnostics. Do not log document plaintext, draft note text, credentials or private encryption material.

Integrators should certify authentication, object ACLs, CSRF, content streaming, concurrency conflicts, malware scanning, privacy, upload limits, key custody, crash recovery and rollout/rollback before making any authenticated production calls.