Returns the metadata of the documents in the patient's medical-record vault (never the
file bytes — use the download endpoint for those).

The vault is gated: it unlocks only once at least one of the patient's bookings with
your organisation has progressed beyond Requested. While every booking is still
merely Requested, this endpoint returns 403 documents_locked (the patient's
profile remains visible; only documents are gated). Returns 404 when the patient has
no booking with you at all.

Document metadata is PHI: every call to this endpoint is recorded in your provider
activity log before the data is returned.