/documents/{id}scope: documents:readDocument metadata + 1-hour presigned download URL.
Confidential (Part 2) documents require the elevated `documents:read:confidential` scope. Without it the endpoint returns 404 — it never reveals existence to non-cleared callers.
curl -H "Authorization: Bearer qrt_xxxxxxxxxxxxxxxx" \
https://quorate.app/api/v1/documents/MEETING_OR_ROW_ID