The Identity Documents APIs would become much more useful to us if we could attach file(s) to them as well. For example, photos/scanned copies of the original document.

Separate permissions for adding vs viewing any attached files would also help safeguard them by restricting who is able to download them after being attached. This is because they wouldn't often need to be viewed again once uploaded, but do need to be available for some period of time (not indefinitely).

Some property or enterprise-wide configuration to automatically archive and remove attachments or entire identity document records after a fixed period of time would also help ensure data isn't kept longer than required.