Access Controls for Wallet Data Exports
Secure report downloads with resource ownership checks, bounded access lifetimes and safe file handling, rather than relying on an obscure export URL.
Overview
When translating these concepts into an integration, keep the scope described by the wallet history api with the result. The examples in wallet transaction history and smart contract event logs show how the same distinction affects neighbouring data questions.
Exports can combine public transactions with private labels and customer calculations. Their access rules should be at least as deliberate as the application routes that created them.
Authorise the export resource
Bind the export to tenant, owner and permitted project scope. Check access when creating, inspecting and downloading it. An unpredictable filename helps reduce guessing but is not a substitute for authorisation. Background generation must retain the caller’s allowed scope rather than running with unrestricted customer access by default.
Worked example: a forwarded download link
A user forwards an export link to another account. If the link is intended to require account access, the recipient must still pass ownership or sharing checks. If it is a deliberately signed temporary link, its scope and expiry must be explicit. Do not accidentally mix those two access models.
Test lifecycle boundaries
Include revoked access, expired links, deleted reports and a worker finishing after permissions change. Set safe content types and download names. Avoid exposing local file paths or credentials in errors. Apply retention to generated files and intermediate copies, not only to the database record that points at them.
A practical acceptance test
Generate a report for tenant B and request it with A’s identity through creation-status, download and retry paths. Test revoked access and an expired temporary link. A background worker must preserve the original resource scope. Generated files and intermediate copies should follow retention policy even after the database pointer is deleted.
Questions about the topic
Frequently asked questions
Is an obscure filename sufficient access control?
No. Use an explicit authorisation or signed-access contract.
Should export workers ignore tenant scope?
No. They must preserve the intended resource boundary.
Standards & technical documentation
