From db83eb0a2009c346ece492f89e4ede7fb65d087d Mon Sep 17 00:00:00 2001
From: Karl Rankla <karl.rankla@epilot.cloud>
Date: Fri, 16 Oct 2026 10:43:35 +0300
Subject: [PATCH] docs(integration-toolkit): document file proxy
 allowed_origins

---
 .../integration-toolkit/file-proxy.md             | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/docs/integrations/integration-toolkit/file-proxy.md b/docs/integrations/integration-toolkit/file-proxy.md
index 83566c9d..0f63cced 100644
--- a/docs/integrations/integration-toolkit/file-proxy.md
+++ b/docs/integrations/integration-toolkit/file-proxy.md
@@ -81,6 +81,7 @@ A file proxy use case configuration has four top-level sections:
 | `params` | No | Declares which query parameters are expected in the download URL. |
 | `steps` | **Yes** | Ordered list of HTTP requests to execute. At least one step is required. |
 | `response` | **Yes** | How to extract the file content from the step results. |
+| `allowed_origins` | No | Additional browser origins allowed to call the download URL (CORS). See [Allowed Origins](#allowed-origins). |
 | `requires_vpc` | No | Whether requests should be routed through the VPC proxy for IP allowlisting. Defaults to `false`. |
 
 ## Authentication
@@ -149,6 +150,20 @@ The `params` array declares which query parameters the proxy URL must contain. T
 
 All query parameters (including `integrationId`, and either `useCaseSlug` or `useCaseId`, plus any custom ones) are available in the Handlebars context under `params`.
 
+## Allowed Origins
+
+When a web app calls the download URL from the browser, the request is cross-origin. The epilot portal and epilot 360 origins are always allowed. To call the download URL from any other site (e.g. your own website), list its origin in `allowed_origins`:
+
+```json
+{
+  "allowed_origins": ["https://www.example-utility.de"]
+}
+```
+
+- Each entry must be an `http(s)://` origin and is matched **exactly** against the request's `Origin` header. Wildcards, paths and trailing slashes are not supported.
+- The list adds to the always-allowed epilot origins; it never replaces them.
+- `allowed_origins` controls browser access only (CORS). It is not an access control: requests from other clients, such as server-to-server calls, are not affected.
+
 ## Steps
 
 Steps define the ordered HTTP requests to make against the external system. Each step can reference the results of previous steps, enabling multi-step download flows.