Read the bytes of a sealed source item (reviewer sessions only)
PWB-036. A human governance act: an API key is refused HUMAN_PRINCIPAL_REQUIRED. Returns the source item’s bytes (base64) ONLY when custody re-hashed the stored octets to the sealed digest on this read (observation.state = AVAILABLE_VERIFIED); in every other state bytes_base64 is null and the observation names the state (NOT_FOUND, ACCESS_DENIED, DIGEST_MISMATCH, ERASED, OPERATIONAL_FAILURE, NOT_CHECKED). The item must be a sealed source_manifest_item of this submission (404 otherwise). Every call, served or not, appends a source_bytes_read audit row naming the reader, the item, the bound digest and the resolution entry read. Nothing here claims external availability.
Authorizations
MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).
Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.
Path Parameters
1 - 256