Every successful fetch of GET /api/documents/{id}/download writes a DownloadLog row. It captures the tenantId, the documentId that was fetched, the requestId of the call, and the requester's userAgent, along with createdAt. This gives operators an audit trail of who downloaded which stored PDF and when — useful for documents that carry sensitive content. The write is best-effort: it is fired with void and its failure is only warned, so a logging hiccup never blocks the download itself.
The DownloadLog is written before the bytes are streamed and never blocks the response — a failed insert is logged as a warning, not surfaced to the caller.
Technical section
Data model, API, and internals — visible to developers.