Protected document upload and download
Upload and download authorised client evidence with strict extension, MIME, ownership, visibility, path and size checks.
Guides in this workflow
Follow the guide that matches the exact action, filter, menu change or issue.
Use the generic portal document-upload endpoint
POST a supported document for an owned portal context.
Use the generic portal document-download endpoint
GET an authorised document using its endpoint parameters.
Upload a Scroll/Quill compliance document
POST to /portal_api/scroll_document_upload with application_id and source_module.
Select the Scroll source module
Use full_compliance_applications, license_applications or one_off_compliance.
Provide application_id
The application must exist and belong to the authenticated client/contact.
Provide the uploaded file
Use the endpoint file field expected by the supplied controller.
Understand the 15 MB limit
Scroll uploads larger than 15 MB are rejected.
Understand supported Scroll extensions
PDF, JPG/JPEG, PNG, TXT, DOC/DOCX and XLS/XLSX are supported.
Understand MIME validation
Extension and MIME must match the allow-list.
Understand DOCX/XLSX archive validation
The ZIP container must include [Content_Types].xml and word/document.xml or xl/workbook.xml.
Understand secure storage
Files are stored beneath uploads/clients/scroll_portal/quill_uk with directory 0750 and file 0640 controls.
Understand safe generated filenames
Original names are sanitised for response metadata while stored filenames are generated.
Understand created document records
The module model records Client upload, uploaded status, client/landlord visibility and uploader context.
Download a Scroll document
GET /portal_api/scroll_document_download?id={id}&mod={module}.
Understand download ownership
The document/application must belong to the client, match contact rules and be visible_to_landlord.
Understand download path roots
Only approved Scroll upload or module upload roots are allowed.
Understand secure download headers
Downloads use attachment, nosniff, private no-store and no-cache headers.
Resolve document not found
Check ID, module, ownership, visibility, stored path and readability.
Resolve invalid file type
Use a supported extension with matching MIME and valid Office archive structure.