diff --git a/ereuse_devicehub/resources/documents/documents.py b/ereuse_devicehub/resources/documents/documents.py
index 83d8ebf5..1a1584e8 100644
--- a/ereuse_devicehub/resources/documents/documents.py
+++ b/ereuse_devicehub/resources/documents/documents.py
@@ -61,23 +61,48 @@ class DocumentView(DeviceView):
         args = self.QUERY_PARSER.parse(self.find_args,
                                        flask.request,
                                        locations=('querystring',))
+        ids = []
+        if 'filter' in request.args:
+            filters = json.loads(request.args.get('filter', {}))
+            ids = filters.get('ids', [])
+
+        if not ids and not id:
+            msg = 'Document must be an ID or UUID.'
+            raise teal.marshmallow.ValidationError(msg)
+
         if id:
-            # todo we assume we can pass both device id and action id
-            # for certificates... how is it going to end up being?
             try:
                 id = uuid.UUID(id)
             except ValueError:
                 try:
-                    id = int(id)
+                    ids.append(int(id))
                 except ValueError:
-                    raise teal.marshmallow.ValidationError('Document must be an ID or UUID.')
+                    msg = 'Document must be an ID or UUID.'
+                    raise teal.marshmallow.ValidationError(msg)
                 else:
-                    query = devs.Device.query.filter_by(id=id)
+                    query = devs.Device.query.filter(Device.id.in_(ids))
             else:
                 query = evs.Action.query.filter_by(id=id)
         else:
-            flask.current_app.auth.requires_auth(lambda: None)()  # todo not nice
-            query = self.query(args)
+            query = devs.Device.query.filter(Device.id.in_(ids))
+
+        # if id:
+        #     # todo we assume we can pass both device id and action id
+        #     # for certificates... how is it going to end up being?
+        #     try:
+        #         id = uuid.UUID(id)
+        #     except ValueError:
+        #         try:
+        #             id = int(id)
+        #         except ValueError:
+        #             raise teal.marshmallow.ValidationError('Document must be an ID or UUID.')
+        #         else:
+        #             query = devs.Device.query.filter_by(id=id)
+        #     else:
+        #         query = evs.Action.query.filter_by(id=id)
+        # else:
+        #     flask.current_app.auth.requires_auth(lambda: None)()  # todo not nice
+        #     query = self.query(args)
 
         type = urlutils.URL(flask.request.url).path_parts[-2]
         if type == 'erasures':
diff --git a/tests/test_documents.py b/tests/test_documents.py
index bf11bb4a..0db7d716 100644
--- a/tests/test_documents.py
+++ b/tests/test_documents.py
@@ -70,7 +70,7 @@ def test_erasure_certificate_private_query(user: UserClient):
     doc, response = user.get(res=documents.DocumentDef.t,
                              item='erasures/',
                              query=[
-                                 ('filter', {'id': [snapshot['device']['id']]})],
+                                 ('filter', {'ids': [snapshot['device']['id']]})],
                              accept=ANY)
     assert 'html' in response.content_type
     assert '<html' in doc
@@ -80,7 +80,7 @@ def test_erasure_certificate_private_query(user: UserClient):
                              item='erasures/',
                              query=[
                                  ('filter', {
-                                  'id': [snapshot['device']['id']]}),
+                                  'ids': [snapshot['device']['id']]}),
                                  ('format', 'PDF')
                              ],
                              accept='application/pdf')
@@ -601,7 +601,7 @@ def test_verify_stamp_erasure_certificate(user: UserClient, client: Client):
 
     doc, _ = user.get(res=documents.DocumentDef.t,
                              item='erasures/',
-                             query=[('filter', {'id': [snapshot['device']['id']]})],
+                             query=[('filter', {'ids': [snapshot['device']['id']]})],
                              accept=ANY)
 
     response, _ = client.post(res=documents.DocumentDef.t,
@@ -616,7 +616,7 @@ def test_verify_stamp_erasure_certificate(user: UserClient, client: Client):
     doc, _ = user.get(res=documents.DocumentDef.t,
                              item='erasures/',
                              query=[
-                                 ('filter', {'id': [snapshot['device']['id']]}),
+                                 ('filter', {'ids': [snapshot['device']['id']]}),
                                  ('format', 'PDF')
                              ],
                              accept='application/pdf')