A short-lived link to the document's file

GET

/groups/{groupId}/documents/{documentId}/download

curl --request GET \
  --url https://app.grouperly.com/api/v2/groups/example/documents/example/download \
  --header 'Authorization: Bearer <token>'

The link works for a few minutes (expiresAt). The response is never cached (Cache-Control: no-store). A key, or an app without roster.youth.read, reaches only the documents the list shows it (2.21.0). A file still being checked for malware answers 503 unavailable with Retry-After, usually for a minute or two, and one the scanner found malware in is not found (2.26.2).

Authorizations

• apiKey
  documents:read
• appToken
  https://api.grouperly.com/documents.read

Parameters

Path Parameters

groupId

required

string

The credential’s group

documentId

required

string

A document in the group

Responses

200

OK

Media typeapplication/json

object

url

required

Fetch it right away; don’t store or share it

string

expiresAt

required

string format: date-time

Example^generated

{
  "url": "example",
  "expiresAt": "2026-04-15T12:00:00Z"
}

Headers

X-RateLimit-Limit

integer

Requests allowed per minute for this credential

X-RateLimit-Remaining

integer

Requests left in this window

X-RateLimit-Reset

integer

When the window ends (Unix seconds)

401

Missing, unknown, revoked or expired credential (unauthorized)

Media typeapplication/json

object

error

required

object

code

required

Stable and machine-readable: unauthorized, forbidden, insufficient_scope, key_owner_not_leader, app_not_installed, scope_not_allowed, app_suspended, rate_limited, not_found, invalid_parameter, invalid_body, invalid_profile, invalid_descriptor, no_profile, already_exists, not_a_member, position_inactive, position_full, already_assigned, assignment_ended, version_not_current, nothing_to_pay, payments_not_ready, payload_too_large, first_party_only, terms_required, child_account, assistant_off, not_for_assistant, assistant_failed, not_a_draft, storage_full, unavailable, internal_error. New codes may be added.

string

message

required

For people; wording may change.

string

parameter

The query parameter (invalid_parameter) or body field (invalid_body, not_a_member) at fault.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "parameter": "example"
  }
}

403

A key: wrong group (forbidden), missing scope (insufficient_scope), or its creator no longer leads the group (key_owner_not_leader). An app’s token: missing scope (insufficient_scope), the group hasn’t installed the app (app_not_installed) or allowed the scope (scope_not_allowed, the message has the consent link), the person may not do this in the group (forbidden), Grouperly paused the app (app_suspended), the person hasn’t accepted Grouperly’s current Terms (terms_required: refresh their token, then send them to the hub’s /account/welcome), or it’s a child’s account (child_account)

Media typeapplication/json

object

error

required

object

code

required

Stable and machine-readable: unauthorized, forbidden, insufficient_scope, key_owner_not_leader, app_not_installed, scope_not_allowed, app_suspended, rate_limited, not_found, invalid_parameter, invalid_body, invalid_profile, invalid_descriptor, no_profile, already_exists, not_a_member, position_inactive, position_full, already_assigned, assignment_ended, version_not_current, nothing_to_pay, payments_not_ready, payload_too_large, first_party_only, terms_required, child_account, assistant_off, not_for_assistant, assistant_failed, not_a_draft, storage_full, unavailable, internal_error. New codes may be added.

string

message

required

For people; wording may change.

string

parameter

The query parameter (invalid_parameter) or body field (invalid_body, not_a_member) at fault.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "parameter": "example"
  }
}

Headers

X-RateLimit-Limit

integer

Requests allowed per minute for this credential

X-RateLimit-Remaining

integer

Requests left in this window

X-RateLimit-Reset

integer

When the window ends (Unix seconds)

404

Not found (not_found)

Media typeapplication/json

object

error

required

object

code

required

Stable and machine-readable: unauthorized, forbidden, insufficient_scope, key_owner_not_leader, app_not_installed, scope_not_allowed, app_suspended, rate_limited, not_found, invalid_parameter, invalid_body, invalid_profile, invalid_descriptor, no_profile, already_exists, not_a_member, position_inactive, position_full, already_assigned, assignment_ended, version_not_current, nothing_to_pay, payments_not_ready, payload_too_large, first_party_only, terms_required, child_account, assistant_off, not_for_assistant, assistant_failed, not_a_draft, storage_full, unavailable, internal_error. New codes may be added.

string

message

required

For people; wording may change.

string

parameter

The query parameter (invalid_parameter) or body field (invalid_body, not_a_member) at fault.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "parameter": "example"
  }
}

Headers

X-RateLimit-Limit

integer

Requests allowed per minute for this credential

X-RateLimit-Remaining

integer

Requests left in this window

X-RateLimit-Reset

integer

When the window ends (Unix seconds)

429

Rate limited (rate_limited)

Media typeapplication/json

object

error

required

object

code

required

Stable and machine-readable: unauthorized, forbidden, insufficient_scope, key_owner_not_leader, app_not_installed, scope_not_allowed, app_suspended, rate_limited, not_found, invalid_parameter, invalid_body, invalid_profile, invalid_descriptor, no_profile, already_exists, not_a_member, position_inactive, position_full, already_assigned, assignment_ended, version_not_current, nothing_to_pay, payments_not_ready, payload_too_large, first_party_only, terms_required, child_account, assistant_off, not_for_assistant, assistant_failed, not_a_draft, storage_full, unavailable, internal_error. New codes may be added.

string

message

required

For people; wording may change.

string

parameter

The query parameter (invalid_parameter) or body field (invalid_body, not_a_member) at fault.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "parameter": "example"
  }
}

Headers

X-RateLimit-Limit

integer

Requests allowed per minute for this credential

X-RateLimit-Remaining

integer

Requests left in this window

X-RateLimit-Reset

integer

When the window ends (Unix seconds)

Retry-After

integer

Seconds to wait

503

An app’s token for someone new, while Grouperly’s sign-in can’t be reached (unavailable); try again

Media typeapplication/json

object

error

required

object

code

required

Stable and machine-readable: unauthorized, forbidden, insufficient_scope, key_owner_not_leader, app_not_installed, scope_not_allowed, app_suspended, rate_limited, not_found, invalid_parameter, invalid_body, invalid_profile, invalid_descriptor, no_profile, already_exists, not_a_member, position_inactive, position_full, already_assigned, assignment_ended, version_not_current, nothing_to_pay, payments_not_ready, payload_too_large, first_party_only, terms_required, child_account, assistant_off, not_for_assistant, assistant_failed, not_a_draft, storage_full, unavailable, internal_error. New codes may be added.

string

message

required

For people; wording may change.

string

parameter

The query parameter (invalid_parameter) or body field (invalid_body, not_a_member) at fault.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "parameter": "example"
  }
}