Thank you for the summary of the subject, here are the answers to your questions :

• Is a combination of those requests enough for a read-only access?
  => Yes absolutly, these 2 requests will allows you to download the file with the proper metadata

• By using access from the Intranet for example with a curl library or the like, do I understand well that we could make the call going just between servers?
  => Yes, there is a simple exemple, assuming that you already retrieved the file name and knows the node ID :

$ch = curl_init();

$path = "/var/www/d7/sites/default/files/api/"; //An apache writable path on this server
$title = "Copies écran GoFAST.pptx"; //Retrieved using GET : api/node/node

//Set URLs and inform cURL this is a file transfer
curl_setopt($ch, CURLOPT_URL, "https://gofast.ceo-vision.com/api/node/content?nid=19840");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_BINARYTRANSFER, 1);

//Set mandatory headers as described in the documentation
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
  "Content-Type: application/octet-stream",
  "Content-Disposition: attachment",
  "Authorization: XXXXXX" //Your user Authorization as described in the documentation
));

//Retrieve the file
$output = curl_exec($ch);

//Write the file in the server
file_put_contents($path . $title, $output);

curl_close($ch);

• And we could have for example 2 users with different access rights – one for Extanet shared documents, one for the internal Organisations? Or does that not make sense?
  => Yes, multiple users with different Authorization can makes sense for security reasons, even if in practical, the front end users will never get the Authorization informations because all the work is done server side

• I remember that you also mentioned that somehow the approach was simpler when restricting access to _Public spaces. Is that the case?
  => I'm not sure I remember but it might be the fact that a non extranet user in GoFAST have access to all public spaces

• I regularly get the response message "This Content-Type is not implemented by the server" (as JSON) but the document downloads OK. Is that as expected?
  => Please set the headers as shown in the exemple

Don't hesitate to come back to me if you have further questions !

My understanding – to implement 2. we need to use the API, and I’ve experimented a bit (really a tiny bit) with the API

To get a node as an attachment, you call https://[server]/api/node/content?nid=[nodeid] with a request header like this

Where Authorization is the Base-64-encoded string username:password for a user with LOCAL authentication to GoFAST and access rights to the space from where you want to get data. I tried it for a user api-pub that I created who is internal and mainly has access to PUBLIC

One could use, I think, https://[server]/api/node/node?nid=1125 to get the name of the document (and the type) – there only with Authorization in the request header

Questions:

1.   Is a combination of those requests enough for a read-only access?
   

2.   By using access from the Intranet for example with a curl library or the like, do I understand well that we could make the call going just between servers?
   

3.   And we could have for example 2 users with different access rights – one for Extanet shared documents, one for the internal Organisations? Or does that not make sense?
   

4.   I remember that you also mentioned that somehow the approach was simpler when restricting access to _Public spaces. Is that the case?
   

5.   I regularly get the response message     "This Content-Type is not implemented by the server" (as JSON) but the document downloads OK. Is that as expected?
   

6.   Indeed if you could share examples or an example, that would be great
   

So, 1. – Just using Webdav for publishing – not recommended for security reasons, well understood

2. and 3. Either link to a file at a node on Documenta or copying said file

3. Seems the most feasible. We only want to read from GoFAST, i.e. access the current version, not update (at least not now)

This option would be basically a periodic copy from a GoFAST space (with the folder structure) to the intranet. We won't recommend this option as it could lead to potential security issues, out of bounds of our security support.

The naming conventions and the overwrite policies has to be defined as it's not a standard mechanism.

2. So this is basically an API request to GoFAST from our Intranet, I assume, without a copy. Is the request then client based (does the client access the GoFAST server?)
   Not necessary, Intranet server can make a call to GoFAST platform

3. And that is the same as 2 just with a copy being fetched. Would that work with updating files as well? What would actually be done?
   You can find more information in our technical documentation:
   https://gofast-docs.readthedocs.io/en/latest/docs-gofast-development/api-rest.html#action-preview

I would be interested to learn a bit more about what is actually going on in 1) 2) or 3), and how it would appear for users, or to see examples, if you have that?
I can ask some of our customers for examples.

1. GoFAST platform send the Publication files from Public spaces/sub-spaces to Intranet/web-site (Ceo-Vision can make technical configuration)

• Do I understand well that this is just an export to the filesystem somewhere on a remote server?
• How are the files then named?
• Would there be a folder structure or one flat folder?
• Is there a synchronisation, i.e. would that be a periodic push? If yes, would new versions overwrite the old version, i.e. would we see updates?
• They could be accessed from a website using some get-file-from-folder mechanism, or imported into another system?

2. Intranet/web-site makes a request to GoFAST platform (public space/sub-space) each time your users need to visualize these files. Publication files on web-site/Intranet (files are not stored, no copy in Intranet/web-site; Customer can do it if you have the skills or our team can do the configurations )

• So this is basically an API request to GoFAST from our Intranet, I assume, without a copy. Is the request then client based (does the client access the GoFAST server?)

3. Intranet/web-site is looking for Publication files in GoFAST Public space/sub-space and the users see the copy of files in web-site/Intranet (customer can do it if you have the skills or our team can do the configurations)

• And that is the same as 2 just with a copy being fetched. Would that work with updating files as well? What would actually be done?

4. If you want to publish files in your web-site/Intranet from different collaborative spaces of GoFAST platform, it will be more complicated..... NO. We do not want that...