Security and Limits
The proxy is designed so a linked service can integrate your APIs without exposing them:
- Server-side only — requests are sent from Seekdown's servers, so your endpoint and
its credential are never revealed to the page or the visitor.
- Public addresses only — a linked service can only reach public internet hosts.
Requests to private, internal-network or loopback addresses are rejected, so the proxy can't be pointed at internal infrastructure.
- Assistants only — linked services run on assistants, not search centers.
- Allowed methods —
GET,POST,PUTandDELETE. - Request timeout — a call that doesn't respond within about a minute is aborted.
- Dynamic values are contained — a
{{params.x}}value is URL-encoded in the URL and stripped of
control characters in headers, so it can't inject extra path, query or headers. Placeholders are allowed only in the path, query or a header value — never in the host — so a value can never redirect the request. If a referenced param isn't supplied, the call fails instead of sending a partial request.
Troubleshooting
- The call fails immediately — check the URL is a public
https://address; internal or
private hosts are blocked by design.
- The endpoint reports "unauthorized" — confirm the Header name matches what your API
expects and that the stored secret is current. Use Remove stored secret and set it again if in doubt.
- Nothing happens on submit — make sure the action or form is calling
executeProxyRequest (or sendProxyForm) with the exact Service ID.