Matrix42 Professional applies several validation checks when files are uploaded to the platform in order to reduce the risk of harmful or unsupported files being stored in the system.

During upload, the platform detects the type of the file from its content and compares it with the file extension. This helps prevent files from disguising their actual type.

Archive files (such as compressed files) are validated as containers, but their internal contents are not inspected during upload.

Depending on system configuration and security policies, certain file types may be restricted from being uploaded. For example, executable or script-based file formats may be blocked to reduce security risks.

If a file fails validation checks, the upload is rejected.

Where Validation Applies

When you turn on file.upload.type.validation.enabled, the platform validates files that users upload in Agent UI and in the Classic UI.

Files that arrive through integrations are validated only when you also turn on the separate setting file.upload.type.validation.integrations.enabled. The setting covers these channels:

• Uploads and request attachments from Pro Self-Service.
• File uploads through the external REST API.
• Attachments of mail imported through GraphAPI.

Both settings are off by default. Turning on the first setting alone therefore never changes how your integrations behave.

Allowed File Types

All channels use the same list of allowed file types. You maintain the list in one place, the platform setting file.upload.allowed.types, as a comma-separated list of file extensions without dots. The value * allows all file types, and an empty value blocks all uploads. The integrations setting only decides whether the list is applied to integration channels. It does not create a separate list.

Two further settings influence the result. The setting file.upload.allow.unknown.types decides whether files whose content type cannot be determined are accepted, and it is on by default. The setting file.upload.fail.on.validation.error decides what happens when the check itself cannot be completed, for example because of a timeout or an internal error. It is on by default, so such files are rejected.

The Integrations Setting

The setting file.upload.type.validation.integrations.enabled is hidden, so it does not appear in the platform settings list. Turning it on changes how your integrations behave, because an integration that uploaded a file successfully before can start to receive errors afterwards. To turn the setting on, add it with the Add new setting option in the platform settings editor and set the value to true.

We recommend that you first try the setting in a test environment, and that the people who maintain your integrations check how the integrations handle the error responses described below before you turn it on in production.

What Integrations Receive When a File is Rejected

Pro Self-Service uploads and the external REST API answer a rejected file with the HTTP status 415 (Unsupported Media Type). The response body is JSON and contains these fields:

• code always has the value FILE_TYPE_NOT_ALLOWED.
• message contains a readable explanation that names the file and the allowed types.
• filename contains the name of the rejected file.
• allowedTypes lists up to ten allowed file types in alphabetical order, and truncated is true when the list is longer.
• reasonCode tells why the file was rejected.
• extension contains the extension of the file name, and detectedExtension contains the extension that the platform detected from the file content.

The field reasonCode has one of these values:

Because the status code and the field code are the same for every reason, integrations that need to react differently should read reasonCode. Integrations that upload files on behalf of users should also show or log the field message.

Mail that is imported through GraphAPI is handled differently, because no sender is waiting for an answer. The platform skips the rejected attachment, imports the mail with its other attachments, and records a note for each skipped attachment in the Exception attribute of the email data card. The note names the file and gives the reason.

Channels That Are Not Validated

File type validation covers the channels listed above and does not cover every path through which files enter the system. For example, it does not cover mail import through IMAP, the legacy bulk upload of Classic Self-Service, the provisioning upload endpoint or the legacy file upload web service, even when both settings are on.