guestbook response can be required for file download

Author: pdurbin

doc/release-notes/12001-api-support-termofuse-guestbook.md

@@ -148,6 +148,12 @@ See the note above about support for REFI-QDA files. Screenshots of the previewe
 
 ## API Updates
 
+- A guestbook response can be passed to file access (file download) APIs when required. This is explained in greater detail under "backward incompatible changes" below. See the [guides](https://guides.dataverse.org/en/6.10/api/dataaccess.html#basic-file-access), #12001, and #12110.
+- CRUD endpoints for guestbooks were added. (Note: There is no update or delete at this time. You can disable a guestbook and create a new one.) See the [guides](https://guides.dataverse.org/en/6.10/api/native-api.html#guestbooks), #12001, and #12110.
+  - Create a guestbook
+  - Get a guestbook
+  - Get a list of guestbooks linked to a collection (dataverse)
+  - Enable/disable a guestbook
 - The MyData API now supports the `metadata_fields`, `sort`, `order`, `show_collections` and `fq` parameters, which enhances its functionality and brings it in line with the Search API. See [the guides](https://guides.dataverse.org/en/6.10/api/native-api.html#mydata) and #12009.
 - This release removes an undocumented restriction on the API calls to get, set, and delete [archival status](https://guides.dataverse.org/en/6.10/api/native-api.html#get-the-archival-status-of-a-dataset-by-version). They did not work on deaccessioned dataset versions and now do. See #12065.
 - Dataset templates can be listed and deleted for a given collection (dataverse). See [the guides](https://guides.dataverse.org/en/6.10/api/native-api.html#list-single-template-by-its-identifier), #11918, and #11969. The default template can also be set. See [the guides](https://guides.dataverse.org/en/6.10/api/native-api.html#set-a-default-template-for-a-collection), #11914 and #11989.
@@ -164,6 +170,32 @@ This release contains important security updates. If you are not receiving secur
 
 Generally speaking, see the [API Changelog](https://guides.dataverse.org/en/latest/api/changelog.html) for a list of backward-incompatible API changes.
 
+### A Guestbook Response Can Be Required for File Access (File Download) APIs
+
+The following File Access (File Download) APIs will now return `400` (`Bad Request`) if a required guestbook response is not supplied.
+
+GET APIs
+
+  - **/api/access/datafile/{fileId:.+}**
+  - **/api/access/datafiles/{fileIds}**
+  - **/api/access/dataset/{id}**
+  - **/api/access/dataset/{id}/versions/{versionId}**
+
+POST APIs
+
+  - **/api/access/datafiles**
+  - **/api/access/datafile/bundle/{fileId}**
+
+PUT APIs (when `dataverse.files.guestbook-at-request=true`)
+
+  - **/api/access/datafile/{id}/requestAccess**
+
+To construct the JSON to send as a guestbook response you must first retrieve the guestbook for the dataset whose files you are trying to access. The guestbook may include custom questions. Call `GET /api/guestbooks/{id}` with the `guestbookId` from the dataset (the `guestbookId` should be included in the `400` error mentioned above).
+
+Using the guestbook and custom questions, build a guestbook response in JSON with `"guestbookResponse":{}` and send it in the body of a POST call. (You can find a JSON example in the [guides](https://guides.dataverse.org/en/6.10/api/dataaccess.html#basic-file-access) for the general format.)
+
+This procedure can also be found in the API Guide under [Data Access API](https://guides.dataverse.org/en/6.10/api/dataaccess.html#basic-file-access) and #12110.
+
 ### Archival Zip Filename Change
 
 The filename of the archival zipped bag produced by the `LocalSubmitToArchiveCommand` archiver now has a "." character before the "v" (for version number) to mirror the filename used by other archivers. For example, the filename will look like