Retrieving a record can involve personal answers, captured images and a signed PDF. Treat the task as access to participant information, even when it happens inside a background integration rather than on a staff screen.
Retrieve only what the task needs
Use search results to identify the record, then fetch details when required. Personal record reads are logged by the service. Broadly fetching every record's answers for a simple arrival count creates unnecessary handling of sensitive information.
The details response can include values, participants, tags, flags and chain information. Follow the response schema rather than assuming that every record includes every optional field or asset.
Interpret purgedAt
When purgedAt is non-null, the retained record and its personal content no longer have the same availability. Values are empty, flag values are empty and PDF or photo retrieval returns 404. Retained proof does not mean the original personal content remains downloadable.
Make this state understandable in your own interface. “Personal content unavailable” is more useful than showing empty fields as though the participant never answered them. Do not automatically create a replacement document to fill the gap.
Distinguish voiding from purging
Voiding changes the record's state while retaining it. It is not equivalent to deleting all stored content. Use void waiver only when that is the intended record action, and do not describe it to an operator as erasing the person.
Your destination system may hold earlier exports. A change in the source does not automatically remove a PDF you previously copied elsewhere. Keep your own retention process aligned with your organization's responsibilities.
Diagnose without copying sensitive data
For an access issue, preserve the record ID, endpoint, status and request ID. Do not paste full answers or captured IDs into an ordinary support message. If a deeper review is necessary, agree on an appropriate channel first.
See PDF retrieval for readiness and download handling, and authentication for keeping integration credentials out of participant-facing applications.