Messages, attachments, read acknowledgements and delivery evidence

Understand download response protections

Know that protected downloads send a safe filename, Content-Disposition and X-Content-Type-Options: nosniff.

Audience: Authorised inbox staffPermission: Per-account Reply for sending; View for reading and downloadingModule v1.0.0 · 2026.07.30-r20.5

Exact navigationAdmin Area → WhatsApp → Inbox → Open conversation

Before you begin

Confirm the module is active and select the intended WhatsApp account before changing any operational record.
Use an account with the stated native CRM capability and per-account access.
Test with controlled customer/contact data before relying on live verification, email or CRM automation.

What this guide covers

Know that protected downloads send a safe filename, Content-Disposition and X-Content-Type-Options: nosniff. These instructions follow the supplied r20.5 controller, model, view, installer, connector and automation flow.

Exact step-by-step process

Open Admin Area → WhatsApp → Inbox → Open conversation.
Locate the account, conversation, setting, session or evidence relevant to “Understand download response protections”.
Review the displayed value or behaviour against this guide’s code-backed rules.
Do not change unrelated account, CRM or connector settings while verifying the result.
Confirm the expected state in the related Inbox, Connections, customer history, native CRM record or Audit Trail.

Fields, choices and supported possibilities

Reply textmaximum 10,000 characters

Attachmentoptional when text is present

Maximum attachment sizeadministrator setting, 1–32 MB

Message direction and WhatsApp message IDMessage direction and WhatsApp message ID

Code-backed validations and workflow rules

A send request requires reply permission and either non-empty text or one accepted attachment.
The server validates MIME type using file content and stores a randomised filename in the protected upload area.
Opening an unread conversation asks the linked device to send a real read acknowledgement before clearing CRM unread state.
Know that protected downloads send a safe filename, Content-Disposition and X-Content-Type-Options: nosniff.

Expected result and verification

The requested action completes without a permission, validation, connector or native CRM error.
The selected account or conversation shows the expected state without changing another account’s data.
Where the action creates evidence, confirm the message, native record, verification event, portal history or audit entry is present.

Security, privacy and troubleshooting checks

Never expose connector tokens, loopback ports, authentication directories or raw customer verification replies.
Use the supported Connections, Access Control, Settings and Audit Trail pages rather than editing runtime or database records directly.
If the expected control is missing, verify both native capability and per-account permission before treating it as an installation fault.