Protected document upload and download

Understand safe generated filenames

Original names are sanitised for response metadata while stored filenames are generated.

Audience: CRM administrators, integration developers, external portal backend teams and security reviewersPermission: Valid short-lived client sessionModule v1.0.0
Exact navigationExternal backend → Proplix API Gateway document endpoints
Before you begin
  • Confirm the module is active and use the exact navigation shown above.
  • Use an account with the stated module and core CRM permissions.
  • Use known test records when changing statuses, visibility, saved filters or global navigation.

What this guide covers

Original names are sanitised for response metadata while stored filenames are generated. The instructions below follow the supplied module’s live menu, controller, form, model and JavaScript flow.

Exact step-by-step process

  1. Open External backend → Proplix API Gateway document endpoints.
  2. Locate the record, endpoint, field or action used to understand safe generated filenames.
  3. Complete the displayed values exactly as described in this guide.
  4. Select the available save, submit, send, upload, create, update or confirm action.
  5. Return to the related register, portal, activity log or API response and verify the expected result.

Fields, choices and supported possibilities

Workspace or endpointExternal backend → Proplix API Gateway document endpoints
PurposeOriginal names are sanitised for response metadata while stored filenames are generated.

Code-backed validations and workflow rules

  • The action is available only where the supplied module exposes it and the signed-in user or API client meets the stated access conditions.
  • Internal helpers are documented under the visible workflow or endpoint they support rather than presented as invented menu pages.

Expected result and verification

  • The understand safe generated filenames workflow completes without a validation, permission, ownership or availability error.
  • The related record, portal view, activity entry, notification log or API response shows the expected state.
  • Client-visible, public and API data remains limited to the code-backed ownership and visibility rules.

Security, privacy and operational checks

  • Use controlled test records and non-production credentials before wider rollout.
  • Grant least privilege and protect secure links, personal data, uploaded files, signatures, API tokens, allowed origins and server IPs.