Deployment, compatibility routes and limitations

Proplix Secure API Gateway

Use the recommended backend architecture

External browser talks to its own backend; backend holds master token, creates short client sessions and proxies authorised data.

Create a test portal profile

Use a non-production profile, restricted IP and limited sections.

Test session creation

POST bearer + active contact_id and inspect expiry.

Test /me

Call with session token and confirm only allowed/owned sections.

Test client login

Use a controlled client account.

Test registration

Use a controlled email/company and review created CRM records.

Test forgotten password

Confirm expected email behaviour without account disclosure.

Test Service Journeys adapter

Use an owned journey with visible/non-visible data.

Test property/compliance endpoints

Use linked and unlinked properties and certificate visibility.

Test documents

Upload supported and unsupported files, then test authorised/unauthorised downloads.

Test revocation

Revoke profile and confirm subsequent calls fail.

Understand advanced v1 UI limitation

Controller/model capabilities exist but current manage.php does not render the source/key form.

Understand advanced v2 UI limitation

Controller/model capabilities exist but current manage.php does not render module-resource/profile forms.

Understand webhook limitation

The supplied gateway provides request/response APIs, not an outbound webhook administration system.

Understand token recovery limitation

One-time tokens cannot be recovered; create a replacement and revoke the old profile/key.

Run production verification

Validate TLS, IP whitelist, rate limit, permissions, ownership, logs, expiry, revocation, module adapters and file controls.