cloudpdf 3.0.0.alpha.16 → 3.0.0.alpha.18

data/reference.md

@@ -252,6 +252,95 @@ client.doc.download(
 </dl>
 
 
+</dd>
+</dl>
+</details>
+
+<details><summary><code>client.doc.<a href="/lib/CloudPDF/doc/client.rb">download_link</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocDownloadLink200Response</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+The link opens the layer as it is when created: once the layer changes, it answers 404, so create it right before handing it over. It downloads that one file and nothing else, and a password-protected document is checked when the link is created. Deployments that verify tokens with their own keys (JWKS) mint links on their backend: a doc token with `layer_name`, a `download: { docVersion, mode: "incremental" }` claim and a short `exp`, passed as `link` on the versioned download URL.
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.doc.download_link(
+  doc_id: "docId",
+  layer_name: "layerName"
+)
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**doc_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**layer_name:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**expires_in:** `Integer` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::RequestOptions` 
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
 </dd>
 </dl>
 </details>
@@ -502,7 +591,7 @@ client.doc.text(
 <dl>
 <dd>
 
-Unauthenticated, but requires a browser Origin header, checked against the grant allowlist. Unknown, revoked, and disabled tokens are indistinguishable (404). Passphrase-protected grants return 422 SharePasswordRequired until `password` is supplied. Mounted only when the deployment can sign (HS256 mode).
+Unauthenticated, but requires a browser Origin header, checked against the grant allowlist. Unknown, revoked, and disabled tokens are indistinguishable (404). Passphrase-protected grants return 422 SharePasswordRequired until `password` is supplied. A link that asks its visitors who they are on open returns 422 VisitorIdentityRequired until the required answers are given; `error.details` carries `fields` (what the link asks), `missing`, `invalid`, `purpose` and `privacyUrl`. A link that asks before the first change issues the session at once with `visitor.identityRequest`, and writes answer 403 VisitorIdentityRequired with the same details until the visitor exchanges again with their answers. Answers that can not be taken answer 422 on any link. Mounted only when the deployment can sign (HS256 mode).
 </dd>
 </dl>
 </dd>
@@ -548,6 +637,30 @@ client.shares.exchange(share_token: "shareToken")
 <dl>
 <dd>
 
+**visitor_handle:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**restart:** `Internal::Types::Boolean` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**visitor_identity:** `CloudPDF::Shares::Types::SharesExchangeRequestVisitorIdentity` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **request_options:** `CloudPDF::Shares::RequestOptions` 
     
 </dd>
@@ -620,6 +733,14 @@ client.shares.list(tenant_id: "tenantId")
 <dl>
 <dd>
 
+**archived:** `Internal::Types::Boolean` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **request_options:** `CloudPDF::Shares::RequestOptions` 
     
 </dd>
@@ -694,6 +815,14 @@ client.shares.create(
 <dl>
 <dd>
 
+**layer_mode:** `CloudPDF::Shares::Types::SharesCreateRequestLayerMode` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **layer_name:** `String` 
     
 </dd>
@@ -702,6 +831,38 @@ client.shares.create(
 <dl>
 <dd>
 
+**keep_visitor_layers:** `Internal::Types::Boolean` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**visitor_idle_seconds:** `Integer` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**visitor_identity:** `CloudPDF::Shares::Types::SharesCreateRequestVisitorIdentity` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**identity:** `CloudPDF::Types::Identity` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **scope:** `Internal::Types::Array[String]` 
     
 </dd>
@@ -919,6 +1080,54 @@ client.shares.update(
 <dl>
 <dd>
 
+**layer_mode:** `CloudPDF::Shares::Types::SharesUpdateRequestLayerMode` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**layer_name:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**keep_visitor_layers:** `Internal::Types::Boolean` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**visitor_idle_seconds:** `Integer` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**visitor_identity:** `CloudPDF::Shares::Types::SharesUpdateRequestVisitorIdentity` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**identity:** `CloudPDF::Types::Identity` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **scope:** `Internal::Types::Array[String]` 
     
 </dd>
@@ -979,11 +1188,24 @@ client.shares.update(
 </dl>
 </details>
 
-## Tenants
-<details><summary><code>client.tenants.<a href="/lib/CloudPDF/tenants/client.rb">list</a>() -> CloudPDF::Types::TenantsList200Response</code></summary>
+<details><summary><code>client.shares.<a href="/lib/CloudPDF/shares/client.rb">archive</a>(tenant_id:, share_id:) -> CloudPDF::Types::SharesArchive200Response</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
+<dl>
+<dd>
+
 <dl>
 <dd>
 
+Archiving is final: an archived link never exchanges again, and to share again you create a new link. Pausing (`disabled`) is the reversible stop. An archived link no longer counts as using its shared layer, so that layer can be deleted.
+</dd>
+</dl>
+</dd>
+</dl>
+
 #### 🔌 Usage
 
 <dl>
@@ -993,7 +1215,10 @@ client.shares.update(
 <dd>
 
 ```ruby
-client.tenants.list
+client.shares.archive(
+  tenant_id: "tenantId",
+  share_id: "shareId"
+)
 ```
 </dd>
 </dl>
@@ -1008,7 +1233,7 @@ client.tenants.list
 <dl>
 <dd>
 
-**limit:** `Integer` 
+**tenant_id:** `String` 
     
 </dd>
 </dl>
@@ -1016,7 +1241,7 @@ client.tenants.list
 <dl>
 <dd>
 
-**cursor:** `String` 
+**share_id:** `String` 
     
 </dd>
 </dl>
@@ -1024,7 +1249,7 @@ client.tenants.list
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Tenants::RequestOptions` 
+**request_options:** `CloudPDF::Shares::RequestOptions` 
     
 </dd>
 </dl>
@@ -1036,7 +1261,8 @@ client.tenants.list
 </dl>
 </details>
 
-<details><summary><code>client.tenants.<a href="/lib/CloudPDF/tenants/client.rb">create</a>(request) -> CloudPDF::Types::TenantsCreate200Response</code></summary>
+## Tenants
+<details><summary><code>client.tenants.<a href="/lib/CloudPDF/tenants/client.rb">list</a>() -> CloudPDF::Types::TenantsList200Response</code></summary>
 <dl>
 <dd>
 
@@ -1049,7 +1275,7 @@ client.tenants.list
 <dd>
 
 ```ruby
-client.tenants.create(id: "id")
+client.tenants.list
 ```
 </dd>
 </dl>
@@ -1064,7 +1290,7 @@ client.tenants.create(id: "id")
 <dl>
 <dd>
 
-**id:** `String` 
+**limit:** `Integer` 
     
 </dd>
 </dl>
@@ -1072,7 +1298,7 @@ client.tenants.create(id: "id")
 <dl>
 <dd>
 
-**name:** `String` 
+**cursor:** `String` 
     
 </dd>
 </dl>
@@ -1092,7 +1318,7 @@ client.tenants.create(id: "id")
 </dl>
 </details>
 
-<details><summary><code>client.tenants.<a href="/lib/CloudPDF/tenants/client.rb">get</a>(tenant_id:) -> CloudPDF::Types::TenantsGet200Response</code></summary>
+<details><summary><code>client.tenants.<a href="/lib/CloudPDF/tenants/client.rb">create</a>(request) -> CloudPDF::Types::TenantsCreate200Response</code></summary>
 <dl>
 <dd>
 
@@ -1105,7 +1331,7 @@ client.tenants.create(id: "id")
 <dd>
 
 ```ruby
-client.tenants.get(tenant_id: "tenantId")
+client.tenants.create(id: "id")
 ```
 </dd>
 </dl>
@@ -1120,7 +1346,15 @@ client.tenants.get(tenant_id: "tenantId")
 <dl>
 <dd>
 
-**tenant_id:** `String` 
+**id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**name:** `String` 
     
 </dd>
 </dl>
@@ -1140,11 +1374,11 @@ client.tenants.get(tenant_id: "tenantId")
 </dl>
 </details>
 
-<details><summary><code>client.tenants.<a href="/lib/CloudPDF/tenants/client.rb">delete</a>(tenant_id:) -> </code></summary>
+<details><summary><code>client.tenants.<a href="/lib/CloudPDF/tenants/client.rb">get</a>(tenant_id:) -> CloudPDF::Types::TenantsGet200Response</code></summary>
 <dl>
 <dd>
 
-#### 📝 Description
+#### 🔌 Usage
 
 <dl>
 <dd>
@@ -1152,13 +1386,15 @@ client.tenants.get(tenant_id: "tenantId")
 <dl>
 <dd>
 
-Destroys the tenant and everything in its namespace — documents, layers, stored bytes, audit history. Irreversible.
+```ruby
+client.tenants.get(tenant_id: "tenantId")
+```
 </dd>
 </dl>
 </dd>
 </dl>
 
-#### 🔌 Usage
+#### ⚙️ Parameters
 
 <dl>
 <dd>
@@ -1166,11 +1402,57 @@ Destroys the tenant and everything in its namespace — documents, layers, store
 <dl>
 <dd>
 
-```ruby
-client.tenants.delete(tenant_id: "tenantId")
-```
-</dd>
-</dl>
+**tenant_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Tenants::RequestOptions` 
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
+</dd>
+</dl>
+</details>
+
+<details><summary><code>client.tenants.<a href="/lib/CloudPDF/tenants/client.rb">delete</a>(tenant_id:) -> </code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+Destroys the tenant and everything in its namespace — documents, layers, stored bytes, audit history. Irreversible.
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.tenants.delete(tenant_id: "tenantId")
+```
+</dd>
+</dl>
 </dd>
 </dl>
 
@@ -1443,7 +1725,39 @@ client.documents.list(tenant_id: "tenantId")
 <dl>
 <dd>
 
-**state:** `CloudPDF::Documents::Types::ListDocumentsRequestState` 
+**state:** `CloudPDF::Documents::Types::ListDocumentsRequestState` — Only documents in this state. Without it, every state except deleting.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**q:** `String` — Only documents whose name contains this text, ignoring case.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**folder_id:** `String` — Only documents directly in this folder (root: the top level). Without it, documents in every folder.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**sort:** `CloudPDF::Documents::Types::ListDocumentsRequestSort` — createdAt (default), name (ignoring case), or size (stored bytes; 0 while pending).
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**order:** `CloudPDF::Documents::Types::ListDocumentsRequestOrder` — Defaults to the reading order of the sort: A to Z for name, newest and largest first otherwise.
     
 </dd>
 </dl>
@@ -1577,6 +1891,88 @@ client.documents.delete(
 </dl>
 
 
+</dd>
+</dl>
+</details>
+
+<details><summary><code>client.documents.<a href="/lib/CloudPDF/documents/client.rb">update</a>(tenant_id:, id:, request) -> CloudPDF::Types::DocumentsUpdate200Response</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+A document that is being deleted answers 404.
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.documents.update(
+  tenant_id: "tenantId",
+  id: "id",
+  name: "name"
+)
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**tenant_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**name:** `String` — What people call the document: shown in dashboards, searched and sorted by. 1 to 255 characters, no control characters, no leading or trailing whitespace. Names need not be unique.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Documents::RequestOptions` 
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
 </dd>
 </dl>
 </details>
@@ -1909,6 +2305,22 @@ client.documents.import_from(tenant_id: "tenantId")
 <dl>
 <dd>
 
+**name:** `String` — What people call the document: shown in dashboards, searched and sorted by. 1 to 255 characters, no control characters, no leading or trailing whitespace. Names need not be unique.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**folder_id:** `String` — A folder id, or root for the top level.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **metadata:** `Internal::Types::Hash[String, Object]` 
     
 </dd>
@@ -2017,6 +2429,22 @@ client.documents.init(
 <dl>
 <dd>
 
+**name:** `String` — What people call the document: shown in dashboards, searched and sorted by. 1 to 255 characters, no control characters, no leading or trailing whitespace. Names need not be unique.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**folder_id:** `String` — A folder id, or root for the top level.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **metadata:** `Internal::Types::Hash[String, Object]` 
     
 </dd>
@@ -2077,12 +2505,12 @@ client.documents.init(
 </dl>
 </details>
 
-## Tokens
-<details><summary><code>client.tokens.<a href="/lib/CloudPDF/tokens/client.rb">issue</a>(tenant_id:, request) -> CloudPDF::Types::TokensIssue200Response</code></summary>
+## Folders
+<details><summary><code>client.folders.<a href="/lib/CloudPDF/folders/client.rb">list</a>(tenant_id:) -> CloudPDF::Types::FoldersList200Response</code></summary>
 <dl>
 <dd>
 
-#### 📝 Description
+#### 🔌 Usage
 
 <dl>
 <dd>
@@ -2090,13 +2518,15 @@ client.documents.init(
 <dl>
 <dd>
 
-kind "tenant" requires the API token — authority mints only downward. Mounted only when the deployment can sign (HS256 mode); asymmetric deployments mint with their own private key.
+```ruby
+client.folders.list(tenant_id: "tenantId")
+```
 </dd>
 </dl>
 </dd>
 </dl>
 
-#### 🔌 Usage
+#### ⚙️ Parameters
 
 <dl>
 <dd>
@@ -2104,23 +2534,23 @@ kind "tenant" requires the API token — authority mints only downward. Mounted
 <dl>
 <dd>
 
-```ruby
-client.tokens.issue(tenant_id: "tenantId")
-```
-</dd>
-</dl>
+**tenant_id:** `String` 
+    
 </dd>
 </dl>
 
-#### ⚙️ Parameters
-
 <dl>
 <dd>
 
+**limit:** `Integer` 
+    
+</dd>
+</dl>
+
 <dl>
 <dd>
 
-**tenant_id:** `String` 
+**cursor:** `String` 
     
 </dd>
 </dl>
@@ -2128,7 +2558,7 @@ client.tokens.issue(tenant_id: "tenantId")
 <dl>
 <dd>
 
-**request:** `CloudPDF::Types::TokensIssueRequest` 
+**parent_id:** `String` — Only the folders directly in this folder (root: the top level). Without it, every folder.
     
 </dd>
 </dl>
@@ -2136,7 +2566,7 @@ client.tokens.issue(tenant_id: "tenantId")
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Tokens::RequestOptions` 
+**request_options:** `CloudPDF::Folders::RequestOptions` 
     
 </dd>
 </dl>
@@ -2148,7 +2578,7 @@ client.tokens.issue(tenant_id: "tenantId")
 </dl>
 </details>
 
-<details><summary><code>client.tokens.<a href="/lib/CloudPDF/tokens/client.rb">revoke</a>(tenant_id:, jti:, request) -> </code></summary>
+<details><summary><code>client.folders.<a href="/lib/CloudPDF/folders/client.rb">create</a>(tenant_id:, request) -> CloudPDF::Types::FoldersCreate200Response</code></summary>
 <dl>
 <dd>
 
@@ -2160,7 +2590,7 @@ client.tokens.issue(tenant_id: "tenantId")
 <dl>
 <dd>
 
-Mounted only when the deployment enables token revocation.
+409 Conflict carries `details.reason`: `name-taken` (a sibling has the name, ignoring case; `details.name`) or `too-deep` (folders nest at most 100 levels; `details.maxDepth`). 404 when the parent folder does not exist.
 </dd>
 </dl>
 </dd>
@@ -2175,9 +2605,9 @@ Mounted only when the deployment enables token revocation.
 <dd>
 
 ```ruby
-client.tokens.revoke(
+client.folders.create(
   tenant_id: "tenantId",
-  jti: "jti"
+  name: "name"
 )
 ```
 </dd>
@@ -2201,15 +2631,7 @@ client.tokens.revoke(
 <dl>
 <dd>
 
-**jti:** `String` 
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**reason:** `String` 
+**name:** `String` — What people call the folder: 1 to 255 characters, no control characters, no leading or trailing whitespace, and unique among the folder's siblings, ignoring case.
     
 </dd>
 </dl>
@@ -2217,7 +2639,7 @@ client.tokens.revoke(
 <dl>
 <dd>
 
-**expires_at_seconds:** `Integer` 
+**parent_id:** `String` — A folder id, or root for the top level.
     
 </dd>
 </dl>
@@ -2225,7 +2647,7 @@ client.tokens.revoke(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Tokens::RequestOptions` 
+**request_options:** `CloudPDF::Folders::RequestOptions` 
     
 </dd>
 </dl>
@@ -2237,25 +2659,10 @@ client.tokens.revoke(
 </dl>
 </details>
 
-## Doc Annotations
-<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">list_all</a>(doc_id:, layer_name:) -> CloudPDF::Types::AnnotationList</code></summary>
-<dl>
-<dd>
-
-#### 📝 Description
-
-<dl>
-<dd>
-
+<details><summary><code>client.folders.<a href="/lib/CloudPDF/folders/client.rb">get</a>(tenant_id:, folder_id:) -> CloudPDF::Types::FoldersGet200Response</code></summary>
 <dl>
 <dd>
 
-Returns one entry per page plus the audit-log cursor for reconciling subsequent document events. Page order is unspecified; join by `page` (a `PageRef`) when display order matters.
-</dd>
-</dl>
-</dd>
-</dl>
-
 #### 🔌 Usage
 
 <dl>
@@ -2265,9 +2672,9 @@ Returns one entry per page plus the audit-log cursor for reconciling subsequent
 <dd>
 
 ```ruby
-client.doc.annotations.list_all(
-  doc_id: "docId",
-  layer_name: "layerName"
+client.folders.get(
+  tenant_id: "tenantId",
+  folder_id: "folderId"
 )
 ```
 </dd>
@@ -2283,15 +2690,7 @@ client.doc.annotations.list_all(
 <dl>
 <dd>
 
-**doc_id:** `String` 
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**layer_name:** `String` 
+**tenant_id:** `String` 
     
 </dd>
 </dl>
@@ -2299,7 +2698,7 @@ client.doc.annotations.list_all(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**folder_id:** `String` 
     
 </dd>
 </dl>
@@ -2307,7 +2706,7 @@ client.doc.annotations.list_all(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Annotations::RequestOptions` 
+**request_options:** `CloudPDF::Folders::RequestOptions` 
     
 </dd>
 </dl>
@@ -2319,11 +2718,11 @@ client.doc.annotations.list_all(
 </dl>
 </details>
 
-<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">list</a>(doc_id:, layer_name:, page_key:) -> CloudPDF::Types::AnnotationList</code></summary>
+<details><summary><code>client.folders.<a href="/lib/CloudPDF/folders/client.rb">delete</a>(tenant_id:, folder_id:) -> </code></summary>
 <dl>
 <dd>
 
-#### 🔌 Usage
+#### 📝 Description
 
 <dl>
 <dd>
@@ -2331,19 +2730,13 @@ client.doc.annotations.list_all(
 <dl>
 <dd>
 
-```ruby
-client.doc.annotations.list(
-  doc_id: "docId",
-  layer_name: "layerName",
-  page_key: "pageKey"
-)
-```
+Without recursive, a folder with anything inside is refused: 409 Conflict with `details.reason` `not-empty` and what it holds, counted over every level below, in `details.folders` and `details.documents`. With recursive=true, the folder and every folder under it go at once, and every document in them stops opening, leaves every list and stops answering its share links at once; their stored files and links are removed in the background. Uploads into those folders that have not committed cannot commit.
 </dd>
 </dl>
 </dd>
 </dl>
 
-#### ⚙️ Parameters
+#### 🔌 Usage
 
 <dl>
 <dd>
@@ -2351,15 +2744,26 @@ client.doc.annotations.list(
 <dl>
 <dd>
 
-**doc_id:** `String` 
-    
+```ruby
+client.folders.delete(
+  tenant_id: "tenantId",
+  folder_id: "folderId"
+)
+```
+</dd>
+</dl>
 </dd>
 </dl>
 
+#### ⚙️ Parameters
+
 <dl>
 <dd>
 
-**layer_name:** `String` 
+<dl>
+<dd>
+
+**tenant_id:** `String` 
     
 </dd>
 </dl>
@@ -2367,7 +2771,7 @@ client.doc.annotations.list(
 <dl>
 <dd>
 
-**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
+**folder_id:** `String` 
     
 </dd>
 </dl>
@@ -2375,7 +2779,7 @@ client.doc.annotations.list(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**recursive:** `Internal::Types::Boolean` — true deletes everything in the folder too. Never the default.
     
 </dd>
 </dl>
@@ -2383,7 +2787,7 @@ client.doc.annotations.list(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Annotations::RequestOptions` 
+**request_options:** `CloudPDF::Folders::RequestOptions` 
     
 </dd>
 </dl>
@@ -2395,7 +2799,7 @@ client.doc.annotations.list(
 </dl>
 </details>
 
-<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">create</a>(doc_id:, layer_name:, page_key:, request) -> CloudPDF::Types::DocAnnotationsCreate200Response</code></summary>
+<details><summary><code>client.folders.<a href="/lib/CloudPDF/folders/client.rb">update</a>(tenant_id:, folder_id:, request) -> CloudPDF::Types::FoldersUpdate200Response</code></summary>
 <dl>
 <dd>
 
@@ -2407,7 +2811,7 @@ client.doc.annotations.list(
 <dl>
 <dd>
 
-Doc JWTs may instead carry collab scopes (annotations:create:self, …) that refine per-annotation authorship rules; the API token is exempt from both.
+409 Conflict with `details.reason` `name-taken` when a sibling has the name, ignoring case.
 </dd>
 </dl>
 </dd>
@@ -2422,13 +2826,10 @@ Doc JWTs may instead carry collab scopes (annotations:create:self, …) that ref
 <dd>
 
 ```ruby
-client.doc.annotations.create(
-  doc_id: "docId",
-  layer_name: "layerName",
-  page_key: "pageKey",
-  request: {
-    key: "value"
-  }
+client.folders.update(
+  tenant_id: "tenantId",
+  folder_id: "folderId",
+  name: "name"
 )
 ```
 </dd>
@@ -2444,7 +2845,7 @@ client.doc.annotations.create(
 <dl>
 <dd>
 
-**doc_id:** `String` 
+**tenant_id:** `String` 
     
 </dd>
 </dl>
@@ -2452,7 +2853,7 @@ client.doc.annotations.create(
 <dl>
 <dd>
 
-**layer_name:** `String` 
+**folder_id:** `String` 
     
 </dd>
 </dl>
@@ -2460,7 +2861,7 @@ client.doc.annotations.create(
 <dl>
 <dd>
 
-**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
+**name:** `String` — What people call the folder: 1 to 255 characters, no control characters, no leading or trailing whitespace, and unique among the folder's siblings, ignoring case.
     
 </dd>
 </dl>
@@ -2468,45 +2869,35 @@ client.doc.annotations.create(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**request_options:** `CloudPDF::Folders::RequestOptions` 
     
 </dd>
 </dl>
+</dd>
+</dl>
 
-<dl>
-<dd>
 
-**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
-    
 </dd>
 </dl>
+</details>
 
+<details><summary><code>client.folders.<a href="/lib/CloudPDF/folders/client.rb">move_into</a>(tenant_id:, folder_id:, request) -> </code></summary>
 <dl>
 <dd>
 
-**request:** `Internal::Types::Hash[String, Object]` 
-    
-</dd>
-</dl>
+#### 📝 Description
 
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Annotations::RequestOptions` 
-    
-</dd>
-</dl>
+<dl>
+<dd>
+
+Up to 1,000 ids in total. A folder moves with everything in it. 404 NotFound names the ids that do not exist or are being deleted in `details.documentIds` and `details.folderIds`. 409 Conflict carries `details.reason`: `cycle` (the destination is a moved folder or inside one; `details.folderId`), `too-deep` (the move would nest folders deeper than 100 levels; `details.maxDepth`) or `name-taken` (a moved folder's name is taken in the destination, ignoring case; `details.name`).
 </dd>
 </dl>
-
-
 </dd>
 </dl>
-</details>
-
-<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">delete</a>(doc_id:, layer_name:, page_key:, annot_key:) -> CloudPDF::Types::DocAnnotationsDelete200Response</code></summary>
-<dl>
-<dd>
 
 #### 🔌 Usage
 
@@ -2517,11 +2908,9 @@ client.doc.annotations.create(
 <dd>
 
 ```ruby
-client.doc.annotations.delete(
-  doc_id: "docId",
-  layer_name: "layerName",
-  page_key: "pageKey",
-  annot_key: "annotKey"
+client.folders.move_into(
+  tenant_id: "tenantId",
+  folder_id: "folderId"
 )
 ```
 </dd>
@@ -2537,7 +2926,7 @@ client.doc.annotations.delete(
 <dl>
 <dd>
 
-**doc_id:** `String` 
+**tenant_id:** `String` 
     
 </dd>
 </dl>
@@ -2545,7 +2934,7 @@ client.doc.annotations.delete(
 <dl>
 <dd>
 
-**layer_name:** `String` 
+**folder_id:** `String` — A folder id, or root for the top level.
     
 </dd>
 </dl>
@@ -2553,7 +2942,7 @@ client.doc.annotations.delete(
 <dl>
 <dd>
 
-**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
+**document_ids:** `Internal::Types::Array[String]` 
     
 </dd>
 </dl>
@@ -2561,7 +2950,7 @@ client.doc.annotations.delete(
 <dl>
 <dd>
 
-**annot_key:** `String` — The annotation's address on the page: `obj:N`, its indirect object number, or `base:N` for an annotation the uploaded file stored inline (without an object number of its own), the position it was born at in the page's /Annots. The name the annotation's `ref` carries for life.
+**folder_ids:** `Internal::Types::Array[String]` 
     
 </dd>
 </dl>
@@ -2569,38 +2958,37 @@ client.doc.annotations.delete(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**request_options:** `CloudPDF::Folders::RequestOptions` 
     
 </dd>
 </dl>
+</dd>
+</dl>
 
-<dl>
-<dd>
 
-**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
-    
 </dd>
 </dl>
+</details>
 
+## Tokens
+<details><summary><code>client.tokens.<a href="/lib/CloudPDF/tokens/client.rb">issue</a>(tenant_id:, request) -> CloudPDF::Types::TokensIssue200Response</code></summary>
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Annotations::RequestOptions` 
-    
-</dd>
-</dl>
-</dd>
-</dl>
-
+#### 📝 Description
 
-</dd>
-</dl>
-</details>
+<dl>
+<dd>
 
-<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">update</a>(doc_id:, layer_name:, page_key:, annot_key:, request) -> CloudPDF::Types::DocAnnotationsUpdate200Response</code></summary>
 <dl>
 <dd>
 
+kind "tenant" requires the API token — authority mints only downward. Mounted only when the deployment can sign (HS256 mode); asymmetric deployments mint with their own private key.
+</dd>
+</dl>
+</dd>
+</dl>
+
 #### 🔌 Usage
 
 <dl>
@@ -2610,15 +2998,7 @@ client.doc.annotations.delete(
 <dd>
 
 ```ruby
-client.doc.annotations.update(
-  doc_id: "docId",
-  layer_name: "layerName",
-  page_key: "pageKey",
-  annot_key: "annotKey",
-  request: {
-    key: "value"
-  }
-)
+client.tokens.issue(tenant_id: "tenantId")
 ```
 </dd>
 </dl>
@@ -2633,7 +3013,7 @@ client.doc.annotations.update(
 <dl>
 <dd>
 
-**doc_id:** `String` 
+**tenant_id:** `String` 
     
 </dd>
 </dl>
@@ -2641,7 +3021,7 @@ client.doc.annotations.update(
 <dl>
 <dd>
 
-**layer_name:** `String` 
+**request:** `CloudPDF::Types::TokensIssueRequest` 
     
 </dd>
 </dl>
@@ -2649,61 +3029,35 @@ client.doc.annotations.update(
 <dl>
 <dd>
 
-**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
+**request_options:** `CloudPDF::Tokens::RequestOptions` 
     
 </dd>
 </dl>
-
-<dl>
-<dd>
-
-**annot_key:** `String` — The annotation's address on the page: `obj:N`, its indirect object number, or `base:N` for an annotation the uploaded file stored inline (without an object number of its own), the position it was born at in the page's /Annots. The name the annotation's `ref` carries for life.
-    
 </dd>
 </dl>
 
-<dl>
-<dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
-    
 </dd>
 </dl>
+</details>
 
+<details><summary><code>client.tokens.<a href="/lib/CloudPDF/tokens/client.rb">revoke</a>(tenant_id:, jti:, request) -> </code></summary>
 <dl>
 <dd>
 
-**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
-    
-</dd>
-</dl>
+#### 📝 Description
 
 <dl>
 <dd>
 
-**request:** `Internal::Types::Hash[String, Object]` 
-    
-</dd>
-</dl>
-
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Annotations::RequestOptions` 
-    
-</dd>
-</dl>
+Mounted only when the deployment enables token revocation.
 </dd>
 </dl>
-
-
 </dd>
 </dl>
-</details>
-
-<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">read_appearance</a>(doc_id:, layer_name:, page_key:, annot_key:) -> String</code></summary>
-<dl>
-<dd>
 
 #### 🔌 Usage
 
@@ -2714,11 +3068,9 @@ client.doc.annotations.update(
 <dd>
 
 ```ruby
-client.doc.annotations.read_appearance(
-  doc_id: "docId",
-  layer_name: "layerName",
-  page_key: "pageKey",
-  annot_key: "annotKey"
+client.tokens.revoke(
+  tenant_id: "tenantId",
+  jti: "jti"
 )
 ```
 </dd>
@@ -2734,15 +3086,7 @@ client.doc.annotations.read_appearance(
 <dl>
 <dd>
 
-**doc_id:** `String` 
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**layer_name:** `String` 
+**tenant_id:** `String` 
     
 </dd>
 </dl>
@@ -2750,7 +3094,7 @@ client.doc.annotations.read_appearance(
 <dl>
 <dd>
 
-**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
+**jti:** `String` 
     
 </dd>
 </dl>
@@ -2758,7 +3102,7 @@ client.doc.annotations.read_appearance(
 <dl>
 <dd>
 
-**annot_key:** `String` — The annotation's address on the page: `obj:N`, its indirect object number, or `base:N` for an annotation the uploaded file stored inline (without an object number of its own), the position it was born at in the page's /Annots. The name the annotation's `ref` carries for life.
+**reason:** `String` 
     
 </dd>
 </dl>
@@ -2766,7 +3110,7 @@ client.doc.annotations.read_appearance(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**expires_at_seconds:** `Integer` 
     
 </dd>
 </dl>
@@ -2774,7 +3118,7 @@ client.doc.annotations.read_appearance(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Annotations::RequestOptions` 
+**request_options:** `CloudPDF::Tokens::RequestOptions` 
     
 </dd>
 </dl>
@@ -2786,7 +3130,8 @@ client.doc.annotations.read_appearance(
 </dl>
 </details>
 
-<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">read_file</a>(doc_id:, layer_name:, page_key:, annot_key:) -> String</code></summary>
+## Doc Annotations
+<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">list_all</a>(doc_id:, layer_name:) -> CloudPDF::Types::AnnotationList</code></summary>
 <dl>
 <dd>
 
@@ -2798,7 +3143,7 @@ client.doc.annotations.read_appearance(
 <dl>
 <dd>
 
-A file that decodes past the server's limit is refused (PayloadTooLarge).
+Returns one entry per page plus the audit-log cursor for reconciling subsequent document events. Page order is unspecified; join by `page` (a `PageRef`) when display order matters.
 </dd>
 </dl>
 </dd>
@@ -2813,11 +3158,9 @@ A file that decodes past the server's limit is refused (PayloadTooLarge).
 <dd>
 
 ```ruby
-client.doc.annotations.read_file(
+client.doc.annotations.list_all(
   doc_id: "docId",
-  layer_name: "layerName",
-  page_key: "pageKey",
-  annot_key: "annotKey"
+  layer_name: "layerName"
 )
 ```
 </dd>
@@ -2849,22 +3192,6 @@ client.doc.annotations.read_file(
 <dl>
 <dd>
 
-**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**annot_key:** `String` — The annotation's address on the page: `obj:N`, its indirect object number, or `base:N` for an annotation the uploaded file stored inline (without an object number of its own), the position it was born at in the page's /Annots. The name the annotation's `ref` carries for life.
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
 **document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
@@ -2885,7 +3212,7 @@ client.doc.annotations.read_file(
 </dl>
 </details>
 
-<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">export_appearance</a>(doc_id:, layer_name:, page_key:, request) -> String</code></summary>
+<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">list</a>(doc_id:, layer_name:, page_key:) -> CloudPDF::Types::AnnotationList</code></summary>
 <dl>
 <dd>
 
@@ -2898,15 +3225,10 @@ client.doc.annotations.read_file(
 <dd>
 
 ```ruby
-client.doc.annotations.export_appearance(
+client.doc.annotations.list(
   doc_id: "docId",
   layer_name: "layerName",
-  page_key: "pageKey",
-  request: {
-    string: {
-      key: "value"
-    }
-  }
+  page_key: "pageKey"
 )
 ```
 </dd>
@@ -2954,14 +3276,6 @@ client.doc.annotations.export_appearance(
 <dl>
 <dd>
 
-**request:** `Internal::Types::Hash[String, Object]` 
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
 **request_options:** `CloudPDF::Doc::Annotations::RequestOptions` 
     
 </dd>
@@ -2974,10 +3288,24 @@ client.doc.annotations.export_appearance(
 </dl>
 </details>
 
-<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">flatten</a>(doc_id:, layer_name:, page_key:, request) -> CloudPDF::Types::DocAnnotationsFlatten200Response</code></summary>
+<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">create</a>(doc_id:, layer_name:, page_key:, request) -> CloudPDF::Types::DocAnnotationsCreate200Response</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
+<dl>
+<dd>
+
 <dl>
 <dd>
 
+Doc JWTs may instead carry collab scopes (annotations:create:self, …) that refine per-annotation authorship rules; the API token is exempt from both.
+</dd>
+</dl>
+</dd>
+</dl>
+
 #### 🔌 Usage
 
 <dl>
@@ -2987,7 +3315,7 @@ client.doc.annotations.export_appearance(
 <dd>
 
 ```ruby
-client.doc.annotations.flatten(
+client.doc.annotations.create(
   doc_id: "docId",
   layer_name: "layerName",
   page_key: "pageKey",
@@ -3069,7 +3397,7 @@ client.doc.annotations.flatten(
 </dl>
 </details>
 
-<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">reorder</a>(doc_id:, layer_name:, page_key:, request) -> CloudPDF::Types::DocAnnotationsReorder200Response</code></summary>
+<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">delete</a>(doc_id:, layer_name:, page_key:, annot_key:) -> CloudPDF::Types::DocAnnotationsDelete200Response</code></summary>
 <dl>
 <dd>
 
@@ -3082,12 +3410,11 @@ client.doc.annotations.flatten(
 <dd>
 
 ```ruby
-client.doc.annotations.reorder(
+client.doc.annotations.delete(
   doc_id: "docId",
   layer_name: "layerName",
   page_key: "pageKey",
-  refs: [],
-  position: "start"
+  annot_key: "annotKey"
 )
 ```
 </dd>
@@ -3127,15 +3454,7 @@ client.doc.annotations.reorder(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+**annot_key:** `String` — The annotation's address on the page: `obj:N`, its indirect object number, or `base:N` for an annotation the uploaded file stored inline (without an object number of its own), the position it was born at in the page's /Annots. The name the annotation's `ref` carries for life.
     
 </dd>
 </dl>
@@ -3143,7 +3462,7 @@ client.doc.annotations.reorder(
 <dl>
 <dd>
 
-**refs:** `Internal::Types::Array[CloudPDF::Types::AnnotationRef]` 
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
 </dl>
@@ -3151,7 +3470,7 @@ client.doc.annotations.reorder(
 <dl>
 <dd>
 
-**position:** `CloudPDF::Types::AnnotationPosition` 
+**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
     
 </dd>
 </dl>
@@ -3171,25 +3490,10 @@ client.doc.annotations.reorder(
 </dl>
 </details>
 
-## Doc Attachments
-<details><summary><code>client.doc.attachments.<a href="/lib/CloudPDF/doc/attachments/client.rb">download</a>(doc_id:, layer_name:, file_key:) -> String</code></summary>
-<dl>
-<dd>
-
-#### 📝 Description
-
-<dl>
-<dd>
-
+<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">update</a>(doc_id:, layer_name:, page_key:, annot_key:, request) -> CloudPDF::Types::DocAnnotationsUpdate200Response</code></summary>
 <dl>
 <dd>
 
-A file that decodes past the server's limit is refused (PayloadTooLarge).
-</dd>
-</dl>
-</dd>
-</dl>
-
 #### 🔌 Usage
 
 <dl>
@@ -3199,10 +3503,14 @@ A file that decodes past the server's limit is refused (PayloadTooLarge).
 <dd>
 
 ```ruby
-client.doc.attachments.download(
+client.doc.annotations.update(
   doc_id: "docId",
   layer_name: "layerName",
-  file_key: "fileKey"
+  page_key: "pageKey",
+  annot_key: "annotKey",
+  request: {
+    key: "value"
+  }
 )
 ```
 </dd>
@@ -3234,7 +3542,7 @@ client.doc.attachments.download(
 <dl>
 <dd>
 
-**file_key:** `String` — The embedded file's name-tree key (its `ref.key`), token-text encoded, as `fieldKey` is.
+**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
     
 </dd>
 </dl>
@@ -3242,7 +3550,7 @@ client.doc.attachments.download(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**annot_key:** `String` — The annotation's address on the page: `obj:N`, its indirect object number, or `base:N` for an annotation the uploaded file stored inline (without an object number of its own), the position it was born at in the page's /Annots. The name the annotation's `ref` carries for life.
     
 </dd>
 </dl>
@@ -3250,35 +3558,45 @@ client.doc.attachments.download(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Attachments::RequestOptions` 
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
 </dl>
-</dd>
-</dl>
 
+<dl>
+<dd>
 
+**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+    
 </dd>
 </dl>
-</details>
 
-<details><summary><code>client.doc.attachments.<a href="/lib/CloudPDF/doc/attachments/client.rb">list</a>(doc_id:, layer_name:) -> CloudPDF::Types::AttachmentList</code></summary>
 <dl>
 <dd>
 
-#### 📝 Description
-
-<dl>
-<dd>
+**request:** `Internal::Types::Hash[String, Object]` 
+    
+</dd>
+</dl>
 
 <dl>
 <dd>
 
-A file-attachment annotation's file is listed with the annotation; read its bytes with `doc.annotations.readFile`.
+**request_options:** `CloudPDF::Doc::Annotations::RequestOptions` 
+    
+</dd>
+</dl>
 </dd>
 </dl>
+
+
 </dd>
 </dl>
+</details>
+
+<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">read_appearance</a>(doc_id:, layer_name:, page_key:, annot_key:) -> String</code></summary>
+<dl>
+<dd>
 
 #### 🔌 Usage
 
@@ -3289,9 +3607,11 @@ A file-attachment annotation's file is listed with the annotation; read its byte
 <dd>
 
 ```ruby
-client.doc.attachments.list(
+client.doc.annotations.read_appearance(
   doc_id: "docId",
-  layer_name: "layerName"
+  layer_name: "layerName",
+  page_key: "pageKey",
+  annot_key: "annotKey"
 )
 ```
 </dd>
@@ -3323,6 +3643,22 @@ client.doc.attachments.list(
 <dl>
 <dd>
 
+**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**annot_key:** `String` — The annotation's address on the page: `obj:N`, its indirect object number, or `base:N` for an annotation the uploaded file stored inline (without an object number of its own), the position it was born at in the page's /Annots. The name the annotation's `ref` carries for life.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
@@ -3331,7 +3667,7 @@ client.doc.attachments.list(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Attachments::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Annotations::RequestOptions` 
     
 </dd>
 </dl>
@@ -3343,11 +3679,24 @@ client.doc.attachments.list(
 </dl>
 </details>
 
-## Doc Forms
-<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">list</a>(doc_id:, layer_name:) -> CloudPDF::Types::DocFormsList200Response</code></summary>
+<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">read_file</a>(doc_id:, layer_name:, page_key:, annot_key:) -> String</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
 <dl>
 <dd>
 
+<dl>
+<dd>
+
+A file that decodes past the server's limit is refused (PayloadTooLarge).
+</dd>
+</dl>
+</dd>
+</dl>
+
 #### 🔌 Usage
 
 <dl>
@@ -3357,9 +3706,11 @@ client.doc.attachments.list(
 <dd>
 
 ```ruby
-client.doc.forms.list(
+client.doc.annotations.read_file(
   doc_id: "docId",
-  layer_name: "layerName"
+  layer_name: "layerName",
+  page_key: "pageKey",
+  annot_key: "annotKey"
 )
 ```
 </dd>
@@ -3391,6 +3742,22 @@ client.doc.forms.list(
 <dl>
 <dd>
 
+**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**annot_key:** `String` — The annotation's address on the page: `obj:N`, its indirect object number, or `base:N` for an annotation the uploaded file stored inline (without an object number of its own), the position it was born at in the page's /Annots. The name the annotation's `ref` carries for life.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
@@ -3399,7 +3766,7 @@ client.doc.forms.list(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Forms::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Annotations::RequestOptions` 
     
 </dd>
 </dl>
@@ -3411,7 +3778,7 @@ client.doc.forms.list(
 </dl>
 </details>
 
-<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">reorder_calculations</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocFormsReorderCalculations200Response</code></summary>
+<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">export_appearance</a>(doc_id:, layer_name:, page_key:, request) -> String</code></summary>
 <dl>
 <dd>
 
@@ -3424,11 +3791,15 @@ client.doc.forms.list(
 <dd>
 
 ```ruby
-client.doc.forms.reorder_calculations(
+client.doc.annotations.export_appearance(
   doc_id: "docId",
   layer_name: "layerName",
-  fields: [],
-  position: "start"
+  page_key: "pageKey",
+  request: {
+    string: {
+      key: "value"
+    }
+  }
 )
 ```
 </dd>
@@ -3460,15 +3831,7 @@ client.doc.forms.reorder_calculations(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
     
 </dd>
 </dl>
@@ -3476,7 +3839,7 @@ client.doc.forms.reorder_calculations(
 <dl>
 <dd>
 
-**fields:** `Internal::Types::Array[CloudPDF::Types::FormFieldRef]` 
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
 </dl>
@@ -3484,7 +3847,7 @@ client.doc.forms.reorder_calculations(
 <dl>
 <dd>
 
-**position:** `CloudPDF::Types::FieldPosition` 
+**request:** `Internal::Types::Hash[String, Object]` 
     
 </dd>
 </dl>
@@ -3492,7 +3855,7 @@ client.doc.forms.reorder_calculations(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Forms::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Annotations::RequestOptions` 
     
 </dd>
 </dl>
@@ -3504,7 +3867,7 @@ client.doc.forms.reorder_calculations(
 </dl>
 </details>
 
-<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">set_value</a>(doc_id:, layer_name:, field_key:, request) -> CloudPDF::Types::DocFormsSetValue200Response</code></summary>
+<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">flatten</a>(doc_id:, layer_name:, page_key:, request) -> CloudPDF::Types::DocAnnotationsFlatten200Response</code></summary>
 <dl>
 <dd>
 
@@ -3517,10 +3880,10 @@ client.doc.forms.reorder_calculations(
 <dd>
 
 ```ruby
-client.doc.forms.set_value(
+client.doc.annotations.flatten(
   doc_id: "docId",
   layer_name: "layerName",
-  field_key: "fieldKey",
+  page_key: "pageKey",
   request: {
     key: "value"
   }
@@ -3555,7 +3918,7 @@ client.doc.forms.set_value(
 <dl>
 <dd>
 
-**field_key:** `String` 
+**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
     
 </dd>
 </dl>
@@ -3587,7 +3950,7 @@ client.doc.forms.set_value(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Forms::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Annotations::RequestOptions` 
     
 </dd>
 </dl>
@@ -3599,7 +3962,7 @@ client.doc.forms.set_value(
 </dl>
 </details>
 
-<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">reset</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocFormsReset200Response</code></summary>
+<details><summary><code>client.doc.annotations.<a href="/lib/CloudPDF/doc/annotations/client.rb">reorder</a>(doc_id:, layer_name:, page_key:, request) -> CloudPDF::Types::DocAnnotationsReorder200Response</code></summary>
 <dl>
 <dd>
 
@@ -3612,9 +3975,12 @@ client.doc.forms.set_value(
 <dd>
 
 ```ruby
-client.doc.forms.reset(
+client.doc.annotations.reorder(
   doc_id: "docId",
-  layer_name: "layerName"
+  layer_name: "layerName",
+  page_key: "pageKey",
+  refs: [],
+  position: "start"
 )
 ```
 </dd>
@@ -3646,6 +4012,14 @@ client.doc.forms.reset(
 <dl>
 <dd>
 
+**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
@@ -3662,7 +4036,7 @@ client.doc.forms.reset(
 <dl>
 <dd>
 
-**refs:** `Internal::Types::Array[CloudPDF::Types::FormFieldRef]` 
+**refs:** `Internal::Types::Array[CloudPDF::Types::AnnotationRef]` 
     
 </dd>
 </dl>
@@ -3670,7 +4044,15 @@ client.doc.forms.reset(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Forms::RequestOptions` 
+**position:** `CloudPDF::Types::AnnotationPosition` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::Annotations::RequestOptions` 
     
 </dd>
 </dl>
@@ -3682,10 +4064,25 @@ client.doc.forms.reset(
 </dl>
 </details>
 
-<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">delete_widget</a>(doc_id:, layer_name:, page_key:, annot_key:) -> CloudPDF::Types::DocFormsDeleteWidget200Response</code></summary>
+## Doc Attachments
+<details><summary><code>client.doc.attachments.<a href="/lib/CloudPDF/doc/attachments/client.rb">download</a>(doc_id:, layer_name:, file_key:) -> String</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
 <dl>
 <dd>
 
+<dl>
+<dd>
+
+A file that decodes past the server's limit is refused (PayloadTooLarge).
+</dd>
+</dl>
+</dd>
+</dl>
+
 #### 🔌 Usage
 
 <dl>
@@ -3695,11 +4092,10 @@ client.doc.forms.reset(
 <dd>
 
 ```ruby
-client.doc.forms.delete_widget(
+client.doc.attachments.download(
   doc_id: "docId",
   layer_name: "layerName",
-  page_key: "pageKey",
-  annot_key: "annotKey"
+  file_key: "fileKey"
 )
 ```
 </dd>
@@ -3731,15 +4127,7 @@ client.doc.forms.delete_widget(
 <dl>
 <dd>
 
-**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**annot_key:** `String` — The annotation's address on the page: `obj:N`, its indirect object number, or `base:N` for an annotation the uploaded file stored inline (without an object number of its own), the position it was born at in the page's /Annots. The name the annotation's `ref` carries for life.
+**file_key:** `String` — The embedded file's name-tree key (its `ref.key`), token-text encoded, as `fieldKey` is.
     
 </dd>
 </dl>
@@ -3755,15 +4143,7 @@ client.doc.forms.delete_widget(
 <dl>
 <dd>
 
-**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**request_options:** `CloudPDF::Doc::Forms::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Attachments::RequestOptions` 
     
 </dd>
 </dl>
@@ -3775,11 +4155,11 @@ client.doc.forms.delete_widget(
 </dl>
 </details>
 
-<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">update_widget</a>(doc_id:, layer_name:, page_key:, annot_key:, request) -> CloudPDF::Types::DocFormsUpdateWidget200Response</code></summary>
+<details><summary><code>client.doc.attachments.<a href="/lib/CloudPDF/doc/attachments/client.rb">list</a>(doc_id:, layer_name:) -> CloudPDF::Types::AttachmentList</code></summary>
 <dl>
 <dd>
 
-#### 🔌 Usage
+#### 📝 Description
 
 <dl>
 <dd>
@@ -3787,13 +4167,24 @@ client.doc.forms.delete_widget(
 <dl>
 <dd>
 
-```ruby
-client.doc.forms.update_widget(
+A file-attachment annotation's file is listed with the annotation; read its bytes with `doc.annotations.readFile`.
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.doc.attachments.list(
   doc_id: "docId",
-  layer_name: "layerName",
-  page_key: "pageKey",
-  annot_key: "annotKey",
-  patch: {}
+  layer_name: "layerName"
 )
 ```
 </dd>
@@ -3825,7 +4216,7 @@ client.doc.forms.update_widget(
 <dl>
 <dd>
 
-**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
 </dl>
@@ -3833,15 +4224,51 @@ client.doc.forms.update_widget(
 <dl>
 <dd>
 
-**annot_key:** `String` — The annotation's address on the page: `obj:N`, its indirect object number, or `base:N` for an annotation the uploaded file stored inline (without an object number of its own), the position it was born at in the page's /Annots. The name the annotation's `ref` carries for life.
+**request_options:** `CloudPDF::Doc::Attachments::RequestOptions` 
     
+</dd>
+</dl>
+</dd>
+</dl>
+
+
+</dd>
+</dl>
+</details>
+
+## Doc Forms
+<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">list</a>(doc_id:, layer_name:) -> CloudPDF::Types::DocFormsList200Response</code></summary>
+<dl>
+<dd>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.doc.forms.list(
+  doc_id: "docId",
+  layer_name: "layerName"
+)
+```
+</dd>
+</dl>
 </dd>
 </dl>
 
+#### ⚙️ Parameters
+
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+<dl>
+<dd>
+
+**doc_id:** `String` 
     
 </dd>
 </dl>
@@ -3849,7 +4276,7 @@ client.doc.forms.update_widget(
 <dl>
 <dd>
 
-**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+**layer_name:** `String` 
     
 </dd>
 </dl>
@@ -3857,7 +4284,7 @@ client.doc.forms.update_widget(
 <dl>
 <dd>
 
-**patch:** `CloudPDF::Types::WidgetPatch` 
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
 </dl>
@@ -3877,7 +4304,7 @@ client.doc.forms.update_widget(
 </dl>
 </details>
 
-<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">reorder_widgets</a>(doc_id:, layer_name:, page_key:, request) -> CloudPDF::Types::DocFormsReorderWidgets200Response</code></summary>
+<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">reorder_calculations</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocFormsReorderCalculations200Response</code></summary>
 <dl>
 <dd>
 
@@ -3890,11 +4317,10 @@ client.doc.forms.update_widget(
 <dd>
 
 ```ruby
-client.doc.forms.reorder_widgets(
+client.doc.forms.reorder_calculations(
   doc_id: "docId",
   layer_name: "layerName",
-  page_key: "pageKey",
-  widgets: [],
+  fields: [],
   position: "start"
 )
 ```
@@ -3927,14 +4353,6 @@ client.doc.forms.reorder_widgets(
 <dl>
 <dd>
 
-**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
 **document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
@@ -3951,7 +4369,7 @@ client.doc.forms.reorder_widgets(
 <dl>
 <dd>
 
-**widgets:** `Internal::Types::Array[CloudPDF::Types::AnnotationRef]` 
+**fields:** `Internal::Types::Array[CloudPDF::Types::FormFieldRef]` 
     
 </dd>
 </dl>
@@ -3959,7 +4377,7 @@ client.doc.forms.reorder_widgets(
 <dl>
 <dd>
 
-**position:** `CloudPDF::Types::AnnotationPosition` 
+**position:** `CloudPDF::Types::FieldPosition` 
     
 </dd>
 </dl>
@@ -3979,8 +4397,7 @@ client.doc.forms.reorder_widgets(
 </dl>
 </details>
 
-## Doc Metadata
-<details><summary><code>client.doc.metadata.<a href="/lib/CloudPDF/doc/metadata/client.rb">get</a>(doc_id:, layer_name:) -> CloudPDF::Types::DocumentMetadata</code></summary>
+<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">set_value</a>(doc_id:, layer_name:, field_key:, request) -> CloudPDF::Types::DocFormsSetValue200Response</code></summary>
 <dl>
 <dd>
 
@@ -3993,9 +4410,13 @@ client.doc.forms.reorder_widgets(
 <dd>
 
 ```ruby
-client.doc.metadata.get(
+client.doc.forms.set_value(
   doc_id: "docId",
-  layer_name: "layerName"
+  layer_name: "layerName",
+  field_key: "fieldKey",
+  request: {
+    key: "value"
+  }
 )
 ```
 </dd>
@@ -4027,6 +4448,14 @@ client.doc.metadata.get(
 <dl>
 <dd>
 
+**field_key:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
@@ -4035,7 +4464,23 @@ client.doc.metadata.get(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Metadata::RequestOptions` 
+**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request:** `Internal::Types::Hash[String, Object]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::Forms::RequestOptions` 
     
 </dd>
 </dl>
@@ -4047,8 +4492,7 @@ client.doc.metadata.get(
 </dl>
 </details>
 
-## Doc Outline
-<details><summary><code>client.doc.outline.<a href="/lib/CloudPDF/doc/outline/client.rb">get</a>(doc_id:, layer_name:) -> CloudPDF::Types::DocumentOutline</code></summary>
+<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">reset</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocFormsReset200Response</code></summary>
 <dl>
 <dd>
 
@@ -4061,7 +4505,7 @@ client.doc.metadata.get(
 <dd>
 
 ```ruby
-client.doc.outline.get(
+client.doc.forms.reset(
   doc_id: "docId",
   layer_name: "layerName"
 )
@@ -4103,7 +4547,23 @@ client.doc.outline.get(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Outline::RequestOptions` 
+**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**refs:** `Internal::Types::Array[CloudPDF::Types::FormFieldRef]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::Forms::RequestOptions` 
     
 </dd>
 </dl>
@@ -4115,8 +4575,7 @@ client.doc.outline.get(
 </dl>
 </details>
 
-## Doc Pages
-<details><summary><code>client.doc.pages.<a href="/lib/CloudPDF/doc/pages/client.rb">set_scale</a>(doc_id:, layer_name:, page_key:, request) -> CloudPDF::Types::DocPagesSetScale200Response</code></summary>
+<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">delete_widget</a>(doc_id:, layer_name:, page_key:, annot_key:) -> CloudPDF::Types::DocFormsDeleteWidget200Response</code></summary>
 <dl>
 <dd>
 
@@ -4129,10 +4588,11 @@ client.doc.outline.get(
 <dd>
 
 ```ruby
-client.doc.pages.set_scale(
+client.doc.forms.delete_widget(
   doc_id: "docId",
   layer_name: "layerName",
-  page_key: "pageKey"
+  page_key: "pageKey",
+  annot_key: "annotKey"
 )
 ```
 </dd>
@@ -4172,7 +4632,7 @@ client.doc.pages.set_scale(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**annot_key:** `String` — The annotation's address on the page: `obj:N`, its indirect object number, or `base:N` for an annotation the uploaded file stored inline (without an object number of its own), the position it was born at in the page's /Annots. The name the annotation's `ref` carries for life.
     
 </dd>
 </dl>
@@ -4180,7 +4640,7 @@ client.doc.pages.set_scale(
 <dl>
 <dd>
 
-**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
 </dl>
@@ -4188,7 +4648,7 @@ client.doc.pages.set_scale(
 <dl>
 <dd>
 
-**measure:** `CloudPDF::Doc::Pages::Types::DocPagesSetScaleRequestMeasure` 
+**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
     
 </dd>
 </dl>
@@ -4196,7 +4656,7 @@ client.doc.pages.set_scale(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Pages::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Forms::RequestOptions` 
     
 </dd>
 </dl>
@@ -4208,7 +4668,7 @@ client.doc.pages.set_scale(
 </dl>
 </details>
 
-<details><summary><code>client.doc.pages.<a href="/lib/CloudPDF/doc/pages/client.rb">viewports</a>(doc_id:, layer_name:, page_key:) -> CloudPDF::Types::DocPagesViewports200Response</code></summary>
+<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">update_widget</a>(doc_id:, layer_name:, page_key:, annot_key:, request) -> CloudPDF::Types::DocFormsUpdateWidget200Response</code></summary>
 <dl>
 <dd>
 
@@ -4221,10 +4681,12 @@ client.doc.pages.set_scale(
 <dd>
 
 ```ruby
-client.doc.pages.viewports(
+client.doc.forms.update_widget(
   doc_id: "docId",
   layer_name: "layerName",
-  page_key: "pageKey"
+  page_key: "pageKey",
+  annot_key: "annotKey",
+  patch: {}
 )
 ```
 </dd>
@@ -4264,7 +4726,7 @@ client.doc.pages.viewports(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**annot_key:** `String` — The annotation's address on the page: `obj:N`, its indirect object number, or `base:N` for an annotation the uploaded file stored inline (without an object number of its own), the position it was born at in the page's /Annots. The name the annotation's `ref` carries for life.
     
 </dd>
 </dl>
@@ -4272,35 +4734,45 @@ client.doc.pages.viewports(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Pages::RequestOptions` 
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
 </dl>
-</dd>
-</dl>
 
+<dl>
+<dd>
 
+**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+    
 </dd>
 </dl>
-</details>
 
-<details><summary><code>client.doc.pages.<a href="/lib/CloudPDF/doc/pages/client.rb">extract</a>(doc_id:, layer_name:, request) -> String</code></summary>
 <dl>
 <dd>
 
-#### 📝 Description
-
-<dl>
-<dd>
+**patch:** `CloudPDF::Types::WidgetPatch` 
+    
+</dd>
+</dl>
 
 <dl>
 <dd>
 
-A read, not a mutation: the source document is untouched and no event is published. Body is `{"pages": PageRef[], "flatten"?: {"usage"?: "display" | "print"}, "includeAnnotations"?: boolean, "includeFormFields"?: boolean}`; the response body is the new PDF. With `flatten` the copy is the pages as they draw for `usage` (`"print"`: a print copy): the annotations and form fields painted in, nothing interactive left, layers in their state for the usage. A flattened copy takes `doc.download` or `doc.download.flattened`, and paints only what the caller may read; `includeAnnotations` and `includeFormFields` choose what it paints, and are refused without `flatten`.
+**request_options:** `CloudPDF::Doc::Forms::RequestOptions` 
+    
+</dd>
+</dl>
 </dd>
 </dl>
+
+
 </dd>
 </dl>
+</details>
+
+<details><summary><code>client.doc.forms.<a href="/lib/CloudPDF/doc/forms/client.rb">reorder_widgets</a>(doc_id:, layer_name:, page_key:, request) -> CloudPDF::Types::DocFormsReorderWidgets200Response</code></summary>
+<dl>
+<dd>
 
 #### 🔌 Usage
 
@@ -4311,14 +4783,12 @@ A read, not a mutation: the source document is untouched and no event is publish
 <dd>
 
 ```ruby
-client.doc.pages.extract(
+client.doc.forms.reorder_widgets(
   doc_id: "docId",
   layer_name: "layerName",
-  request: {
-    string: {
-      key: "value"
-    }
-  }
+  page_key: "pageKey",
+  widgets: [],
+  position: "start"
 )
 ```
 </dd>
@@ -4350,6 +4820,14 @@ client.doc.pages.extract(
 <dl>
 <dd>
 
+**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
@@ -4358,7 +4836,7 @@ client.doc.pages.extract(
 <dl>
 <dd>
 
-**request:** `Internal::Types::Hash[String, Object]` 
+**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
     
 </dd>
 </dl>
@@ -4366,7 +4844,23 @@ client.doc.pages.extract(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Pages::RequestOptions` 
+**widgets:** `Internal::Types::Array[CloudPDF::Types::AnnotationRef]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**position:** `CloudPDF::Types::AnnotationPosition` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::Forms::RequestOptions` 
     
 </dd>
 </dl>
@@ -4378,7 +4872,8 @@ client.doc.pages.extract(
 </dl>
 </details>
 
-<details><summary><code>client.doc.pages.<a href="/lib/CloudPDF/doc/pages/client.rb">flatten</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocPagesFlatten200Response</code></summary>
+## Doc Metadata
+<details><summary><code>client.doc.metadata.<a href="/lib/CloudPDF/doc/metadata/client.rb">get</a>(doc_id:, layer_name:) -> CloudPDF::Types::DocumentMetadata</code></summary>
 <dl>
 <dd>
 
@@ -4391,12 +4886,9 @@ client.doc.pages.extract(
 <dd>
 
 ```ruby
-client.doc.pages.flatten(
+client.doc.metadata.get(
   doc_id: "docId",
-  layer_name: "layerName",
-  request: {
-    key: "value"
-  }
+  layer_name: "layerName"
 )
 ```
 </dd>
@@ -4436,13 +4928,586 @@ client.doc.pages.flatten(
 <dl>
 <dd>
 
-**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+**request_options:** `CloudPDF::Doc::Metadata::RequestOptions` 
     
 </dd>
 </dl>
+</dd>
+</dl>
 
-<dl>
-<dd>
+
+</dd>
+</dl>
+</details>
+
+## Doc Outline
+<details><summary><code>client.doc.outline.<a href="/lib/CloudPDF/doc/outline/client.rb">get</a>(doc_id:, layer_name:) -> CloudPDF::Types::DocumentOutline</code></summary>
+<dl>
+<dd>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.doc.outline.get(
+  doc_id: "docId",
+  layer_name: "layerName"
+)
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**doc_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**layer_name:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::Outline::RequestOptions` 
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
+</dd>
+</dl>
+</details>
+
+## Doc Pages
+<details><summary><code>client.doc.pages.<a href="/lib/CloudPDF/doc/pages/client.rb">set_scale</a>(doc_id:, layer_name:, page_key:, request) -> CloudPDF::Types::DocPagesSetScale200Response</code></summary>
+<dl>
+<dd>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.doc.pages.set_scale(
+  doc_id: "docId",
+  layer_name: "layerName",
+  page_key: "pageKey"
+)
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**doc_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**layer_name:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**measure:** `CloudPDF::Doc::Pages::Types::DocPagesSetScaleRequestMeasure` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::Pages::RequestOptions` 
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
+</dd>
+</dl>
+</details>
+
+<details><summary><code>client.doc.pages.<a href="/lib/CloudPDF/doc/pages/client.rb">viewports</a>(doc_id:, layer_name:, page_key:) -> CloudPDF::Types::DocPagesViewports200Response</code></summary>
+<dl>
+<dd>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.doc.pages.viewports(
+  doc_id: "docId",
+  layer_name: "layerName",
+  page_key: "pageKey"
+)
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**doc_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**layer_name:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**page_key:** `String` — The page's address, `obj:N`: the page's indirect object number, the durable identity every `PageLayout.ref` carries. Mirrors `annotKey` and `fieldKey`.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::Pages::RequestOptions` 
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
+</dd>
+</dl>
+</details>
+
+<details><summary><code>client.doc.pages.<a href="/lib/CloudPDF/doc/pages/client.rb">extract</a>(doc_id:, layer_name:, request) -> String</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+A read, not a mutation: the source document is untouched and no event is published. Body is `{"pages": PageRef[], "flatten"?: {"usage"?: "display" | "print"}, "includeAnnotations"?: boolean, "includeFormFields"?: boolean}`; the response body is the new PDF. With `flatten` the copy is the pages as they draw for `usage` (`"print"`: a print copy): the annotations and form fields painted in, nothing interactive left, layers in their state for the usage. A flattened copy takes `doc.download` or `doc.download.flattened`, and paints only what the caller may read; `includeAnnotations` and `includeFormFields` choose what it paints, and are refused without `flatten`.
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.doc.pages.extract(
+  doc_id: "docId",
+  layer_name: "layerName",
+  request: {
+    string: {
+      key: "value"
+    }
+  }
+)
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**doc_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**layer_name:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request:** `Internal::Types::Hash[String, Object]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::Pages::RequestOptions` 
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
+</dd>
+</dl>
+</details>
+
+<details><summary><code>client.doc.pages.<a href="/lib/CloudPDF/doc/pages/client.rb">flatten</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocPagesFlatten200Response</code></summary>
+<dl>
+<dd>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.doc.pages.flatten(
+  doc_id: "docId",
+  layer_name: "layerName",
+  request: {
+    key: "value"
+  }
+)
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**doc_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**layer_name:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request:** `Internal::Types::Hash[String, Object]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::Pages::RequestOptions` 
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
+</dd>
+</dl>
+</details>
+
+<details><summary><code>client.doc.pages.<a href="/lib/CloudPDF/doc/pages/client.rb">set_name</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocPagesSetName200Response</code></summary>
+<dl>
+<dd>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.doc.pages.set_name(
+  doc_id: "docId",
+  layer_name: "layerName",
+  request: {
+    key: "value"
+  }
+)
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**doc_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**layer_name:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request:** `Internal::Types::Hash[String, Object]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::Pages::RequestOptions` 
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
+</dd>
+</dl>
+</details>
+
+<details><summary><code>client.doc.pages.<a href="/lib/CloudPDF/doc/pages/client.rb">remove_name</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocPagesRemoveName200Response</code></summary>
+<dl>
+<dd>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.doc.pages.remove_name(
+  doc_id: "docId",
+  layer_name: "layerName",
+  request: {
+    key: "value"
+  }
+)
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**doc_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**layer_name:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
 
 **request:** `Internal::Types::Hash[String, Object]` 
     
@@ -4452,7 +5517,181 @@ client.doc.pages.flatten(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Pages::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Pages::RequestOptions` 
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
+</dd>
+</dl>
+</details>
+
+## Doc Redactions
+<details><summary><code>client.doc.redactions.<a href="/lib/CloudPDF/doc/redactions/client.rb">apply</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocRedactionsApply200Response</code></summary>
+<dl>
+<dd>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.doc.redactions.apply(
+  doc_id: "docId",
+  layer_name: "layerName"
+)
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**doc_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**layer_name:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**pages:** `Internal::Types::Array[CloudPDF::Types::PageRef]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**annotations:** `Internal::Types::Array[CloudPDF::Types::AnnotationRef]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::Redactions::RequestOptions` 
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
+</dd>
+</dl>
+</details>
+
+## Doc Signatures
+<details><summary><code>client.doc.signatures.<a href="/lib/CloudPDF/doc/signatures/client.rb">list</a>(doc_id:, layer_name:) -> CloudPDF::Types::DocSignaturesList200Response</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+Describes the bytes the layer is over: the base version's signatures plus the layer's own edits as the last revision. Signed bytes (contents, digests, revision prefixes) are served per base version under /versions.
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.doc.signatures.list(
+  doc_id: "docId",
+  layer_name: "layerName"
+)
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**doc_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**layer_name:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::Signatures::RequestOptions` 
     
 </dd>
 </dl>
@@ -4464,7 +5703,7 @@ client.doc.pages.flatten(
 </dl>
 </details>
 
-<details><summary><code>client.doc.pages.<a href="/lib/CloudPDF/doc/pages/client.rb">set_name</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocPagesSetName200Response</code></summary>
+<details><summary><code>client.doc.signatures.<a href="/lib/CloudPDF/doc/signatures/client.rb">cancel</a>(doc_id:, layer_name:, signing_id:) -> CloudPDF::Types::DocSignaturesCancel200Response</code></summary>
 <dl>
 <dd>
 
@@ -4477,12 +5716,10 @@ client.doc.pages.flatten(
 <dd>
 
 ```ruby
-client.doc.pages.set_name(
+client.doc.signatures.cancel(
   doc_id: "docId",
   layer_name: "layerName",
-  request: {
-    key: "value"
-  }
+  signing_id: "signingId"
 )
 ```
 </dd>
@@ -4514,15 +5751,7 @@ client.doc.pages.set_name(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+**signing_id:** `String` 
     
 </dd>
 </dl>
@@ -4530,7 +5759,7 @@ client.doc.pages.set_name(
 <dl>
 <dd>
 
-**request:** `Internal::Types::Hash[String, Object]` 
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
 </dl>
@@ -4538,7 +5767,7 @@ client.doc.pages.set_name(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Pages::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Signatures::RequestOptions` 
     
 </dd>
 </dl>
@@ -4550,10 +5779,24 @@ client.doc.pages.set_name(
 </dl>
 </details>
 
-<details><summary><code>client.doc.pages.<a href="/lib/CloudPDF/doc/pages/client.rb">remove_name</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocPagesRemoveName200Response</code></summary>
+<details><summary><code>client.doc.signatures.<a href="/lib/CloudPDF/doc/signatures/client.rb">complete</a>(doc_id:, layer_name:, signing_id:, request) -> CloudPDF::Types::DocSignaturesComplete200Response</code></summary>
 <dl>
 <dd>
 
+#### 📝 Description
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+`cms` is the detached CMS over the prepared digest, base64. `expectedVersion` must be what prepare returned. Idempotent by signing id: the same CMS again answers `already-completed`. The new version is the layer's own: only this layer moves to it, and the document and every other layer stay as they were. Refetch the manifest after a completion.
+</dd>
+</dl>
+</dd>
+</dl>
+
 #### 🔌 Usage
 
 <dl>
@@ -4563,11 +5806,14 @@ client.doc.pages.set_name(
 <dd>
 
 ```ruby
-client.doc.pages.remove_name(
+client.doc.signatures.complete(
   doc_id: "docId",
   layer_name: "layerName",
-  request: {
-    key: "value"
+  signing_id: "signingId",
+  cms: "cms",
+  expected_version: {
+    base_sha256: "baseSha256",
+    edits_version: 1
   }
 )
 ```
@@ -4600,6 +5846,14 @@ client.doc.pages.remove_name(
 <dl>
 <dd>
 
+**signing_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
@@ -4608,7 +5862,7 @@ client.doc.pages.remove_name(
 <dl>
 <dd>
 
-**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+**cms:** `String` 
     
 </dd>
 </dl>
@@ -4616,7 +5870,7 @@ client.doc.pages.remove_name(
 <dl>
 <dd>
 
-**request:** `Internal::Types::Hash[String, Object]` 
+**expected_version:** `CloudPDF::Doc::Signatures::Types::DocSignaturesCompleteRequestExpectedVersion` 
     
 </dd>
 </dl>
@@ -4624,7 +5878,7 @@ client.doc.pages.remove_name(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Pages::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Signatures::RequestOptions` 
     
 </dd>
 </dl>
@@ -4636,11 +5890,24 @@ client.doc.pages.remove_name(
 </dl>
 </details>
 
-## Doc Redactions
-<details><summary><code>client.doc.redactions.<a href="/lib/CloudPDF/doc/redactions/client.rb">apply</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocRedactionsApply200Response</code></summary>
+<details><summary><code>client.doc.signatures.<a href="/lib/CloudPDF/doc/signatures/client.rb">analysis</a>(doc_id:, layer_name:) -> CloudPDF::Types::DocSignaturesAnalysis200Response</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
 <dl>
 <dd>
 
+<dl>
+<dd>
+
+Exactly one of `since.signature=<index>` or `since.revision=<index>`; the layer's pending edits are the end. `level=fill|annotate|lta|none` evaluates exploratorily and never becomes a verdict. For history between two base revisions use the version analysis.
+</dd>
+</dl>
+</dd>
+</dl>
+
 #### 🔌 Usage
 
 <dl>
@@ -4650,7 +5917,7 @@ client.doc.pages.remove_name(
 <dd>
 
 ```ruby
-client.doc.redactions.apply(
+client.doc.signatures.analysis(
   doc_id: "docId",
   layer_name: "layerName"
 )
@@ -4684,7 +5951,7 @@ client.doc.redactions.apply(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**since_signature:** `Integer` 
     
 </dd>
 </dl>
@@ -4692,7 +5959,7 @@ client.doc.redactions.apply(
 <dl>
 <dd>
 
-**idempotency_key:** `String` — Names the change: 1 to 255 printable ASCII characters. A retry under the same key on the same layer answers with what the first request committed, and changes nothing.
+**since_revision:** `Integer` 
     
 </dd>
 </dl>
@@ -4700,7 +5967,7 @@ client.doc.redactions.apply(
 <dl>
 <dd>
 
-**pages:** `Internal::Types::Array[CloudPDF::Types::PageRef]` 
+**level:** `CloudPDF::Doc::Signatures::Types::AnalysisSignaturesRequestLevel` 
     
 </dd>
 </dl>
@@ -4708,7 +5975,7 @@ client.doc.redactions.apply(
 <dl>
 <dd>
 
-**annotations:** `Internal::Types::Array[CloudPDF::Types::AnnotationRef]` 
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
 </dl>
@@ -4716,7 +5983,7 @@ client.doc.redactions.apply(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Redactions::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Signatures::RequestOptions` 
     
 </dd>
 </dl>
@@ -4728,8 +5995,7 @@ client.doc.redactions.apply(
 </dl>
 </details>
 
-## Doc Signatures
-<details><summary><code>client.doc.signatures.<a href="/lib/CloudPDF/doc/signatures/client.rb">list</a>(doc_id:, layer_name:) -> CloudPDF::Types::DocSignaturesList200Response</code></summary>
+<details><summary><code>client.doc.signatures.<a href="/lib/CloudPDF/doc/signatures/client.rb">prepare</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocSignaturesPrepare200Response</code></summary>
 <dl>
 <dd>
 
@@ -4741,7 +6007,7 @@ client.doc.redactions.apply(
 <dl>
 <dd>
 
-Describes the bytes the layer is over: the base version's signatures plus the layer's own edits as the last revision. Signed bytes (contents, digests, revision prefixes) are served per base version under /versions.
+Multipart: a JSON `body` part (field, subFilter, digest, contentsSize, signer, certify, lock), naming the appearance PDF it may carry as `resources: { appearance: '<key>' }`, and that PDF as the part `resource:<key>`. A certification (`certify.permission`) additionally requires `doc.sign.certify`. The layer is read-only until the signing completes, is cancelled, or expires (15 minutes). The signature is made over the layer's own base: the upload, or the version its last signature made.
 </dd>
 </dl>
 </dd>
@@ -4756,7 +6022,7 @@ Describes the bytes the layer is over: the base version's signatures plus the la
 <dd>
 
 ```ruby
-client.doc.signatures.list(
+client.doc.signatures.prepare(
   doc_id: "docId",
   layer_name: "layerName"
 )
@@ -4810,10 +6076,25 @@ client.doc.signatures.list(
 </dl>
 </details>
 
-<details><summary><code>client.doc.signatures.<a href="/lib/CloudPDF/doc/signatures/client.rb">cancel</a>(doc_id:, layer_name:, signing_id:) -> CloudPDF::Types::DocSignaturesCancel200Response</code></summary>
+## Doc Versions
+<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">list</a>(doc_id:, layer_name:) -> CloudPDF::Types::DocVersionsList200Response</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
+<dl>
+<dd>
+
 <dl>
 <dd>
 
+Every completed signature makes a new version of its layer; another layer's versions are never listed. Never cached: the list grows.
+</dd>
+</dl>
+</dd>
+</dl>
+
 #### 🔌 Usage
 
 <dl>
@@ -4823,10 +6104,9 @@ client.doc.signatures.list(
 <dd>
 
 ```ruby
-client.doc.signatures.cancel(
+client.doc.versions.list(
   doc_id: "docId",
-  layer_name: "layerName",
-  signing_id: "signingId"
+  layer_name: "layerName"
 )
 ```
 </dd>
@@ -4858,14 +6138,6 @@ client.doc.signatures.cancel(
 <dl>
 <dd>
 
-**signing_id:** `String` 
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
 **document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
@@ -4874,7 +6146,7 @@ client.doc.signatures.cancel(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Signatures::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Versions::RequestOptions` 
     
 </dd>
 </dl>
@@ -4886,7 +6158,7 @@ client.doc.signatures.cancel(
 </dl>
 </details>
 
-<details><summary><code>client.doc.signatures.<a href="/lib/CloudPDF/doc/signatures/client.rb">complete</a>(doc_id:, layer_name:, signing_id:, request) -> CloudPDF::Types::DocSignaturesComplete200Response</code></summary>
+<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">analysis</a>(doc_id:, layer_name:, sha:) -> CloudPDF::Types::DocVersionsAnalysis200Response</code></summary>
 <dl>
 <dd>
 
@@ -4898,7 +6170,7 @@ client.doc.signatures.cancel(
 <dl>
 <dd>
 
-`cms` is the detached CMS over the prepared digest, base64. `expectedVersion` must be what prepare returned. Idempotent by signing id: the same CMS again answers `already-completed`. Every layer of the document then sits over the new version; refetch the manifest after a completion.
+Exactly one of `since.signature` / `since.revision`; `until=<revision>` defaults to the last. The same answer for every caller.
 </dd>
 </dl>
 </dd>
@@ -4913,15 +6185,10 @@ client.doc.signatures.cancel(
 <dd>
 
 ```ruby
-client.doc.signatures.complete(
+client.doc.versions.analysis(
   doc_id: "docId",
   layer_name: "layerName",
-  signing_id: "signingId",
-  cms: "cms",
-  expected_version: {
-    base_sha256: "baseSha256",
-    edits_version: 1
-  }
+  sha: "sha"
 )
 ```
 </dd>
@@ -4953,7 +6220,7 @@ client.doc.signatures.complete(
 <dl>
 <dd>
 
-**signing_id:** `String` 
+**sha:** `String` 
     
 </dd>
 </dl>
@@ -4961,7 +6228,7 @@ client.doc.signatures.complete(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**since_signature:** `Integer` 
     
 </dd>
 </dl>
@@ -4969,7 +6236,7 @@ client.doc.signatures.complete(
 <dl>
 <dd>
 
-**cms:** `String` 
+**since_revision:** `Integer` 
     
 </dd>
 </dl>
@@ -4977,7 +6244,7 @@ client.doc.signatures.complete(
 <dl>
 <dd>
 
-**expected_version:** `CloudPDF::Doc::Signatures::Types::DocSignaturesCompleteRequestExpectedVersion` 
+**level:** `CloudPDF::Doc::Versions::Types::AnalysisVersionsRequestLevel` 
     
 </dd>
 </dl>
@@ -4985,35 +6252,45 @@ client.doc.signatures.complete(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Signatures::RequestOptions` 
+**until_:** `Integer` 
     
 </dd>
 </dl>
-</dd>
-</dl>
 
+<dl>
+<dd>
 
+**policy:** `Integer` 
+    
 </dd>
 </dl>
-</details>
 
-<details><summary><code>client.doc.signatures.<a href="/lib/CloudPDF/doc/signatures/client.rb">analysis</a>(doc_id:, layer_name:) -> CloudPDF::Types::DocSignaturesAnalysis200Response</code></summary>
 <dl>
 <dd>
 
-#### 📝 Description
-
-<dl>
-<dd>
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+    
+</dd>
+</dl>
 
 <dl>
 <dd>
 
-Exactly one of `since.signature=<index>` or `since.revision=<index>`; the layer's pending edits are the end. `level=fill|annotate|lta|none` evaluates exploratorily and never becomes a verdict. For history between two base revisions use the version analysis.
+**request_options:** `CloudPDF::Doc::Versions::RequestOptions` 
+    
+</dd>
+</dl>
 </dd>
 </dl>
+
+
 </dd>
 </dl>
+</details>
+
+<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">download</a>(doc_id:, layer_name:, sha:) -> String</code></summary>
+<dl>
+<dd>
 
 #### 🔌 Usage
 
@@ -5024,9 +6301,10 @@ Exactly one of `since.signature=<index>` or `since.revision=<index>`; the layer'
 <dd>
 
 ```ruby
-client.doc.signatures.analysis(
+client.doc.versions.download(
   doc_id: "docId",
-  layer_name: "layerName"
+  layer_name: "layerName",
+  sha: "sha"
 )
 ```
 </dd>
@@ -5058,7 +6336,7 @@ client.doc.signatures.analysis(
 <dl>
 <dd>
 
-**since_signature:** `Integer` 
+**sha:** `String` 
     
 </dd>
 </dl>
@@ -5066,7 +6344,76 @@ client.doc.signatures.analysis(
 <dl>
 <dd>
 
-**since_revision:** `Integer` 
+**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Doc::Versions::RequestOptions` 
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
+</dd>
+</dl>
+</details>
+
+<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">revision</a>(doc_id:, layer_name:, sha:, index:) -> String</code></summary>
+<dl>
+<dd>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```ruby
+client.doc.versions.revision(
+  doc_id: "docId",
+  layer_name: "layerName",
+  sha: "sha",
+  index: 1
+)
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**doc_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**layer_name:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**sha:** `String` 
     
 </dd>
 </dl>
@@ -5074,7 +6421,7 @@ client.doc.signatures.analysis(
 <dl>
 <dd>
 
-**level:** `CloudPDF::Doc::Signatures::Types::AnalysisSignaturesRequestLevel` 
+**index:** `Integer` 
     
 </dd>
 </dl>
@@ -5090,7 +6437,7 @@ client.doc.signatures.analysis(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Signatures::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Versions::RequestOptions` 
     
 </dd>
 </dl>
@@ -5102,24 +6449,10 @@ client.doc.signatures.analysis(
 </dl>
 </details>
 
-<details><summary><code>client.doc.signatures.<a href="/lib/CloudPDF/doc/signatures/client.rb">prepare</a>(doc_id:, layer_name:, request) -> CloudPDF::Types::DocSignaturesPrepare200Response</code></summary>
-<dl>
-<dd>
-
-#### 📝 Description
-
-<dl>
-<dd>
-
+<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">signatures</a>(doc_id:, layer_name:, sha:) -> CloudPDF::Types::DocVersionsSignatures200Response</code></summary>
 <dl>
 <dd>
 
-Multipart: a JSON `body` part (field, subFilter, digest, contentsSize, signer, certify, lock), naming the appearance PDF it may carry as `resources: { appearance: '<key>' }`, and that PDF as the part `resource:<key>`. A certification (`certify.permission`) additionally requires `doc.sign.certify`. The layer is read-only until the signing completes, is cancelled, or expires (15 minutes). A layer behind the document head cannot sign (StaleBase).
-</dd>
-</dl>
-</dd>
-</dl>
-
 #### 🔌 Usage
 
 <dl>
@@ -5129,9 +6462,10 @@ Multipart: a JSON `body` part (field, subFilter, digest, contentsSize, signer, c
 <dd>
 
 ```ruby
-client.doc.signatures.prepare(
+client.doc.versions.signatures(
   doc_id: "docId",
-  layer_name: "layerName"
+  layer_name: "layerName",
+  sha: "sha"
 )
 ```
 </dd>
@@ -5163,6 +6497,14 @@ client.doc.signatures.prepare(
 <dl>
 <dd>
 
+**sha:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
@@ -5171,7 +6513,7 @@ client.doc.signatures.prepare(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Signatures::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Versions::RequestOptions` 
     
 </dd>
 </dl>
@@ -5183,8 +6525,7 @@ client.doc.signatures.prepare(
 </dl>
 </details>
 
-## Doc Versions
-<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">list</a>(doc_id:) -> CloudPDF::Types::DocVersionsList200Response</code></summary>
+<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">signature_contents</a>(doc_id:, layer_name:, sha:, field_key:) -> String</code></summary>
 <dl>
 <dd>
 
@@ -5196,7 +6537,7 @@ client.doc.signatures.prepare(
 <dl>
 <dd>
 
-Every completed signature publishes a new version. Never cached: the list grows.
+`fieldKey` is the field's fully qualified name, token-text encoded (the same encoding attachment keys use).
 </dd>
 </dl>
 </dd>
@@ -5211,7 +6552,12 @@ Every completed signature publishes a new version. Never cached: the list grows.
 <dd>
 
 ```ruby
-client.doc.versions.list(doc_id: "docId")
+client.doc.versions.signature_contents(
+  doc_id: "docId",
+  layer_name: "layerName",
+  sha: "sha",
+  field_key: "fieldKey"
+)
 ```
 </dd>
 </dl>
@@ -5234,6 +6580,30 @@ client.doc.versions.list(doc_id: "docId")
 <dl>
 <dd>
 
+**layer_name:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**sha:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**field_key:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
     
 </dd>
@@ -5254,7 +6624,7 @@ client.doc.versions.list(doc_id: "docId")
 </dl>
 </details>
 
-<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">analysis</a>(doc_id:, sha:) -> CloudPDF::Types::DocVersionsAnalysis200Response</code></summary>
+<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">signature_digest</a>(doc_id:, layer_name:, sha:, field_key:, algorithm:) -> String</code></summary>
 <dl>
 <dd>
 
@@ -5266,7 +6636,7 @@ client.doc.versions.list(doc_id: "docId")
 <dl>
 <dd>
 
-Exactly one of `since.signature` / `since.revision`; `until=<revision>` defaults to the last. The same answer for every layer and every caller.
+What a CMS verifier compares its message digest to.
 </dd>
 </dl>
 </dd>
@@ -5281,9 +6651,12 @@ Exactly one of `since.signature` / `since.revision`; `until=<revision>` defaults
 <dd>
 
 ```ruby
-client.doc.versions.analysis(
+client.doc.versions.signature_digest(
   doc_id: "docId",
-  sha: "sha"
+  layer_name: "layerName",
+  sha: "sha",
+  field_key: "fieldKey",
+  algorithm: "sha1"
 )
 ```
 </dd>
@@ -5307,23 +6680,7 @@ client.doc.versions.analysis(
 <dl>
 <dd>
 
-**sha:** `String` 
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**since_signature:** `Integer` 
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**since_revision:** `Integer` 
+**layer_name:** `String` 
     
 </dd>
 </dl>
@@ -5331,7 +6688,7 @@ client.doc.versions.analysis(
 <dl>
 <dd>
 
-**level:** `CloudPDF::Doc::Versions::Types::AnalysisVersionsRequestLevel` 
+**sha:** `String` 
     
 </dd>
 </dl>
@@ -5339,7 +6696,7 @@ client.doc.versions.analysis(
 <dl>
 <dd>
 
-**until_:** `Integer` 
+**field_key:** `String` 
     
 </dd>
 </dl>
@@ -5347,7 +6704,7 @@ client.doc.versions.analysis(
 <dl>
 <dd>
 
-**policy:** `Integer` 
+**algorithm:** `CloudPDF::Doc::Versions::Types::SignatureDigestVersionsRequestAlgorithm` 
     
 </dd>
 </dl>
@@ -5375,7 +6732,8 @@ client.doc.versions.analysis(
 </dl>
 </details>
 
-<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">download</a>(doc_id:, sha:) -> String</code></summary>
+## Doc Metadata Custom
+<details><summary><code>client.doc.metadata.custom.<a href="/lib/CloudPDF/doc/metadata/custom/client.rb">get</a>(doc_id:, layer_name:) -> Internal::Types::Hash[String, String]</code></summary>
 <dl>
 <dd>
 
@@ -5388,9 +6746,9 @@ client.doc.versions.analysis(
 <dd>
 
 ```ruby
-client.doc.versions.download(
+client.doc.metadata.custom.get(
   doc_id: "docId",
-  sha: "sha"
+  layer_name: "layerName"
 )
 ```
 </dd>
@@ -5414,7 +6772,7 @@ client.doc.versions.download(
 <dl>
 <dd>
 
-**sha:** `String` 
+**layer_name:** `String` 
     
 </dd>
 </dl>
@@ -5430,7 +6788,7 @@ client.doc.versions.download(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Versions::RequestOptions` 
+**request_options:** `CloudPDF::Doc::Metadata::Custom::RequestOptions` 
     
 </dd>
 </dl>
@@ -5442,7 +6800,8 @@ client.doc.versions.download(
 </dl>
 </details>
 
-<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">revision</a>(doc_id:, sha:, index:) -> String</code></summary>
+## Documents Layers
+<details><summary><code>client.documents.layers.<a href="/lib/CloudPDF/documents/layers/client.rb">list</a>(tenant_id:, id:) -> CloudPDF::Types::DocumentsLayersList200Response</code></summary>
 <dl>
 <dd>
 
@@ -5455,10 +6814,9 @@ client.doc.versions.download(
 <dd>
 
 ```ruby
-client.doc.versions.revision(
-  doc_id: "docId",
-  sha: "sha",
-  index: 1
+client.documents.layers.list(
+  tenant_id: "tenantId",
+  id: "id"
 )
 ```
 </dd>
@@ -5474,7 +6832,7 @@ client.doc.versions.revision(
 <dl>
 <dd>
 
-**doc_id:** `String` 
+**tenant_id:** `String` 
     
 </dd>
 </dl>
@@ -5482,7 +6840,7 @@ client.doc.versions.revision(
 <dl>
 <dd>
 
-**sha:** `String` 
+**id:** `String` 
     
 </dd>
 </dl>
@@ -5490,7 +6848,7 @@ client.doc.versions.revision(
 <dl>
 <dd>
 
-**index:** `Integer` 
+**limit:** `Integer` 
     
 </dd>
 </dl>
@@ -5498,7 +6856,7 @@ client.doc.versions.revision(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**cursor:** `String` 
     
 </dd>
 </dl>
@@ -5506,7 +6864,15 @@ client.doc.versions.revision(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Versions::RequestOptions` 
+**share_id:** `String` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `CloudPDF::Documents::Layers::RequestOptions` 
     
 </dd>
 </dl>
@@ -5518,7 +6884,7 @@ client.doc.versions.revision(
 </dl>
 </details>
 
-<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">signatures</a>(doc_id:, sha:) -> CloudPDF::Types::DocVersionsSignatures200Response</code></summary>
+<details><summary><code>client.documents.layers.<a href="/lib/CloudPDF/documents/layers/client.rb">delete</a>(tenant_id:, id:, layer_name:) -> </code></summary>
 <dl>
 <dd>
 
@@ -5531,9 +6897,10 @@ client.doc.versions.revision(
 <dd>
 
 ```ruby
-client.doc.versions.signatures(
-  doc_id: "docId",
-  sha: "sha"
+client.documents.layers.delete(
+  tenant_id: "tenantId",
+  id: "id",
+  layer_name: "layerName"
 )
 ```
 </dd>
@@ -5549,7 +6916,7 @@ client.doc.versions.signatures(
 <dl>
 <dd>
 
-**doc_id:** `String` 
+**tenant_id:** `String` 
     
 </dd>
 </dl>
@@ -5557,7 +6924,7 @@ client.doc.versions.signatures(
 <dl>
 <dd>
 
-**sha:** `String` 
+**id:** `String` 
     
 </dd>
 </dl>
@@ -5565,7 +6932,7 @@ client.doc.versions.signatures(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**layer_name:** `String` 
     
 </dd>
 </dl>
@@ -5573,7 +6940,7 @@ client.doc.versions.signatures(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Versions::RequestOptions` 
+**request_options:** `CloudPDF::Documents::Layers::RequestOptions` 
     
 </dd>
 </dl>
@@ -5585,7 +6952,8 @@ client.doc.versions.signatures(
 </dl>
 </details>
 
-<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">signature_contents</a>(doc_id:, sha:, field_key:) -> String</code></summary>
+## Shares Visitors
+<details><summary><code>client.shares.visitors.<a href="/lib/CloudPDF/shares/visitors/client.rb">list</a>(tenant_id:, share_id:) -> CloudPDF::Types::SharesVisitorsList200Response</code></summary>
 <dl>
 <dd>
 
@@ -5597,7 +6965,7 @@ client.doc.versions.signatures(
 <dl>
 <dd>
 
-`fieldKey` is the field's fully qualified name, token-text encoded (the same encoding attachment keys use).
+An archived link's visitors are listed too.
 </dd>
 </dl>
 </dd>
@@ -5612,10 +6980,9 @@ client.doc.versions.signatures(
 <dd>
 
 ```ruby
-client.doc.versions.signature_contents(
-  doc_id: "docId",
-  sha: "sha",
-  field_key: "fieldKey"
+client.shares.visitors.list(
+  tenant_id: "tenantId",
+  share_id: "shareId"
 )
 ```
 </dd>
@@ -5631,7 +6998,7 @@ client.doc.versions.signature_contents(
 <dl>
 <dd>
 
-**doc_id:** `String` 
+**tenant_id:** `String` 
     
 </dd>
 </dl>
@@ -5639,7 +7006,7 @@ client.doc.versions.signature_contents(
 <dl>
 <dd>
 
-**sha:** `String` 
+**share_id:** `String` 
     
 </dd>
 </dl>
@@ -5647,7 +7014,7 @@ client.doc.versions.signature_contents(
 <dl>
 <dd>
 
-**field_key:** `String` 
+**limit:** `Integer` 
     
 </dd>
 </dl>
@@ -5655,7 +7022,7 @@ client.doc.versions.signature_contents(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**cursor:** `String` 
     
 </dd>
 </dl>
@@ -5663,7 +7030,7 @@ client.doc.versions.signature_contents(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Versions::RequestOptions` 
+**request_options:** `CloudPDF::Shares::Visitors::RequestOptions` 
     
 </dd>
 </dl>
@@ -5675,7 +7042,7 @@ client.doc.versions.signature_contents(
 </dl>
 </details>
 
-<details><summary><code>client.doc.versions.<a href="/lib/CloudPDF/doc/versions/client.rb">signature_digest</a>(doc_id:, sha:, field_key:, algorithm:) -> String</code></summary>
+<details><summary><code>client.shares.visitors.<a href="/lib/CloudPDF/shares/visitors/client.rb">delete</a>(tenant_id:, share_id:, visitor_id:) -> </code></summary>
 <dl>
 <dd>
 
@@ -5687,98 +7054,12 @@ client.doc.versions.signature_contents(
 <dl>
 <dd>
 
-What a CMS verifier compares its message digest to.
-</dd>
-</dl>
-</dd>
-</dl>
-
-#### 🔌 Usage
-
-<dl>
-<dd>
-
-<dl>
-<dd>
-
-```ruby
-client.doc.versions.signature_digest(
-  doc_id: "docId",
-  sha: "sha",
-  field_key: "fieldKey",
-  algorithm: "sha1"
-)
-```
-</dd>
-</dl>
-</dd>
-</dl>
-
-#### ⚙️ Parameters
-
-<dl>
-<dd>
-
-<dl>
-<dd>
-
-**doc_id:** `String` 
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**sha:** `String` 
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**field_key:** `String` 
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**algorithm:** `CloudPDF::Doc::Versions::Types::SignatureDigestVersionsRequestAlgorithm` 
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**request_options:** `CloudPDF::Doc::Versions::RequestOptions` 
-    
+Their handle brings them back as a new visitor, who is asked again. Deleting a visitor already deleted changes nothing.
 </dd>
 </dl>
 </dd>
 </dl>
 
-
-</dd>
-</dl>
-</details>
-
-## Doc Metadata Custom
-<details><summary><code>client.doc.metadata.custom.<a href="/lib/CloudPDF/doc/metadata/custom/client.rb">get</a>(doc_id:, layer_name:) -> Internal::Types::Hash[String, String]</code></summary>
-<dl>
-<dd>
-
 #### 🔌 Usage
 
 <dl>
@@ -5788,9 +7069,10 @@ client.doc.versions.signature_digest(
 <dd>
 
 ```ruby
-client.doc.metadata.custom.get(
-  doc_id: "docId",
-  layer_name: "layerName"
+client.shares.visitors.delete(
+  tenant_id: "tenantId",
+  share_id: "shareId",
+  visitor_id: "visitorId"
 )
 ```
 </dd>
@@ -5806,7 +7088,7 @@ client.doc.metadata.custom.get(
 <dl>
 <dd>
 
-**doc_id:** `String` 
+**tenant_id:** `String` 
     
 </dd>
 </dl>
@@ -5814,7 +7096,7 @@ client.doc.metadata.custom.get(
 <dl>
 <dd>
 
-**layer_name:** `String` 
+**share_id:** `String` 
     
 </dd>
 </dl>
@@ -5822,7 +7104,7 @@ client.doc.metadata.custom.get(
 <dl>
 <dd>
 
-**document_password:** `String` — Base64-encoded password for an encrypted document. Valid only with the API token (403 anywhere else). An encrypted document answers 422 DocPasswordRequired when the header is absent. Viewer doc JWTs use the SDK password-session flow instead.
+**visitor_id:** `String` 
     
 </dd>
 </dl>
@@ -5830,7 +7112,7 @@ client.doc.metadata.custom.get(
 <dl>
 <dd>
 
-**request_options:** `CloudPDF::Doc::Metadata::Custom::RequestOptions` 
+**request_options:** `CloudPDF::Shares::Visitors::RequestOptions` 
     
 </dd>
 </dl>