The browser requests metadata and signed download links from the document service through Kong-routed APIs.