> ## Documentation Index > Fetch the complete documentation index at: https://docs.scan.com/llms.txt > Use this file to discover all available pages before exploring further. # Returns the invoice and PFR on a referral > Returns download URLs for the invoice and the sent-back letter of protection on a referral the authenticated group can access. A missing file is left out. Both missing returns an empty `documents` array. The letter of protection is the countersigned file when one is attached. Otherwise it is the latest patient letter of protection. Returns 403 until Scan enables `referral_documents_read` for the group. Uploading a file uses `POST` on this path and a separate permission. ## OpenAPI ````yaml /openapi.yaml get /api/v2/referrals/{referral_id}/documents openapi: 3.1.0 info: title: Scan.com API version: v2 description: >- The Scan.com Partner API creates imaging referrals, schedules visits, and returns radiology reports. servers: - url: https://api.staging.scan.com description: Sandbox - url: https://api.scan.com description: Production security: - BearerAuth: [] tags: - name: Courier SSO description: >- Mint a one-time Courier portal SSO URL with the same Bearer token used for the rest of the API. - name: Webhooks description: >- Outbound HTTP POST notifications sent to your api_credentials.webhook_url when visit or notification status changes. Configure api_credentials on your LawFirm, Practice, CoordinationGroup, Insurance, Employer, or NurseCaseManagementGroup. - name: Order Documents description: >- Retrieve radiology report PDFs, DICOM imaging, and invoices for orders visible to the authenticated group. - name: Locations description: >- Search imaging centers near an address, or rank them for a referral after medical safety answers are on file. Partners submit a preferred center; Scan books the visit. - name: Testing description: Staging-only fixture bootstrap, status advancement, and test webhooks. - name: FHIR description: >- Opt-in FHIR R4 read shapes for DiagnosticReport and ImagingStudy. Not a FHIR server. paths: /api/v2/referrals/{referral_id}/documents: get: tags: - Referrals summary: Returns the invoice and PFR on a referral description: | Returns download URLs for the invoice and the sent-back letter of protection on a referral the authenticated group can access. A missing file is left out. Both missing returns an empty `documents` array. The letter of protection is the countersigned file when one is attached. Otherwise it is the latest patient letter of protection. Returns 403 until Scan enables `referral_documents_read` for the group. Uploading a file uses `POST` on this path and a separate permission. operationId: listReferralDocuments parameters: - name: referral_id in: path required: true description: Referral ID schema: type: string format: uuid responses: '200': description: Invoice and letter of protection downloads content: application/json: schema: type: object required: - documents properties: documents: type: array items: type: object required: - type - url - filename - content_type - created_at properties: type: type: string enum: - invoice - pfr url: type: string format: uri description: Download URL for the file filename: type: string content_type: type: string created_at: type: string format: date-time '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalServerError' security: - BearerAuth: [] components: responses: Unauthorized: description: Missing, expired, or wrong-environment token headers: X-Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: unauthorized: value: error: Unauthorized message: Unauthorized type: authentication_error code: unauthorized request_id: abc-123 documentation_url: https://docs.scan.com/guides/errors#unauthorized expired: value: error: API token expired message: API token expired type: authentication_error code: api_token_expired request_id: abc-123 documentation_url: https://docs.scan.com/guides/errors#api_token_expired Forbidden: description: Endpoint is not enabled for this account headers: X-Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: This endpoint is not enabled for your account message: This endpoint is not enabled for your account type: permission_error code: endpoint_not_enabled request_id: abc-123 documentation_url: https://docs.scan.com/guides/errors#endpoint_not_enabled NotFound: description: Resource not found or not accessible to this account headers: X-Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Referral not found message: Referral not found type: not_found_error code: not_found request_id: abc-123 documentation_url: https://docs.scan.com/guides/errors#not_found TooManyRequests: description: Sandbox request allowance exhausted headers: X-Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Sandbox request limit reached message: Sandbox request limit reached type: rate_limit_error code: sandbox_request_limit_reached request_id: abc-123 documentation_url: https://docs.scan.com/guides/errors#sandbox_request_limit_reached InternalServerError: description: Unexpected internal error headers: X-Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Internal server error message: Internal server error type: api_error code: internal_error request_id: abc-123 documentation_url: https://docs.scan.com/guides/errors#internal_error headers: RequestId: description: Correlate this response with Scan support. schema: type: string schemas: ErrorResponse: type: object properties: error: type: string message: type: string type: type: string example: validation_error code: type: string example: unprocessable_entity request_id: type: string documentation_url: type: string errors: type: array items: type: string required: - error - message - type - code securitySchemes: BearerAuth: type: http scheme: bearer description: > `Authorization: Bearer `. Reuse the same token on later requests until it expires or is revoked. Do not request a new token for each call. The token does not expire after 24 hours. Sandbox tokens come from Get API keys and allow 2,000 successful requests or 7 days, or 90 days with an access code. Failed 4xx/5xx responses do not consume the allowance. Production tokens are issued from the group's API access tab and last until the expiry set there, or until revoked when no expiry is set. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.