Hallo,
ich würde es hier wahrscheinlich tatsächlich über die API machen. Der korrekte Weg den iframe zu befüllen ist folgendermaßen:

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https:// . . ./api/rest/v2/application/jobarchive/archives/ARCHIVNAME/documents/" . $revId . "/file");
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);                                   
curl_setopt($ch, CURLOPT_BINARYTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'C:\\Temp\\cookie.txt');
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
 
$response = curl_exec($ch);
$code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
 
if ($code == 200) {
   $documentData = json_decode($response, true);
 
header('Cache-Control: public');
header('Content-type: application/pdf');
header('Content-Disposition: inline; filename="new.pdf"');
header('Content-Length: '.strlen($response));
echo $response;
 
} else {
    echo "Abfrage nach RevisionId fehlerhaft: Code - " . $code . ", ";
}