diff --git a/pages/api/file/getawaitingsubmissionfromblobproxy.js b/pages/api/file/getawaitingsubmissionfromblobproxy.js
index 2e05852a..6f8e3ef7 100644
--- a/pages/api/file/getawaitingsubmissionfromblobproxy.js
+++ b/pages/api/file/getawaitingsubmissionfromblobproxy.js
@@ -1,30 +1,18 @@
-import {
-    downloadAllProgressFiles,
-    getAllProgressBlobs
-} from "../../../actions/azurestorage";
-import _ from "lodash";
-import nextConnect from "next-connect";
-import middleware from "../middleware/middleware";
 import { getToken } from "../../../actions/core/token";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { hashAPIPath } from "../../../actions/core/hash";
 import axios from "axios";
-import CryptoJS from "crypto-js";
-
-const WORDKEY = process.env.HASHKEY;
-
-const WEBAPI_URL =
-    process.env.RELAY_ROOT ||
-    "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
 const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
 
+const hasValue = (value) =>
+    typeof value === "string" && value.trim().length > 0;
+
 export default async function ApiProxy(req, res) {
     var containerName = req.query.container;
-    var checkHash = req.query.hash;
 
-    if (typeof containerName === "undefined" || containerName.length === 0) {
+    if (!hasValue(containerName)) {
         return res.status(400).json();
     }
 
diff --git a/pages/api/file/getbloblistproxy.js b/pages/api/file/getbloblistproxy.js
index 8032d1c8..10a7b958 100644
--- a/pages/api/file/getbloblistproxy.js
+++ b/pages/api/file/getbloblistproxy.js
@@ -1,36 +1,19 @@
-import {
-    downloadAllProgressFiles,
-    getAllProgressBlobs
-} from "../../../actions/azurestorage";
-import _ from "lodash";
-import nextConnect from "next-connect";
-import middleware from "../middleware/middleware";
 import { getToken } from "../../../actions/core/token";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { hashAPIPath } from "../../../actions/core/hash";
 import axios from "axios";
-import CryptoJS from "crypto-js";
-
-const WORDKEY = process.env.HASHKEY;
-
-const WEBAPI_URL =
-    process.env.RELAY_ROOT ||
-    "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
 const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
 
+const hasValue = (value) =>
+    typeof value === "string" && value.trim().length > 0;
+
 export default async function ApiProxy(req, res) {
     var containerName = req.query.container;
     var casefolderID = req.query.casefolderID;
-    var checkHash = req.query.hash;
 
-    if (
-        typeof containerName === "undefined" ||
-        containerName.length === 0 ||
-        typeof casefolderID === "undefined" ||
-        casefolderID.length === 0
-    ) {
+    if (!hasValue(containerName) || !hasValue(casefolderID)) {
         return res.status(400).json();
     }
 
diff --git a/pages/api/file/getrepsblobproxy.js b/pages/api/file/getrepsblobproxy.js
index 7b377b2d..3a0bb850 100644
--- a/pages/api/file/getrepsblobproxy.js
+++ b/pages/api/file/getrepsblobproxy.js
@@ -1,30 +1,18 @@
-import {
-    downloadAllProgressFiles,
-    getAllProgressBlobs
-} from "../../../actions/azurestorage";
-import _ from "lodash";
-import nextConnect from "next-connect";
-import middleware from "../middleware/middleware";
 import { getToken } from "../../../actions/core/token";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { hashAPIPath } from "../../../actions/core/hash";
 import axios from "axios";
-import CryptoJS from "crypto-js";
-
-const WORDKEY = process.env.HASHKEY;
-
-const WEBAPI_URL =
-    process.env.RELAY_ROOT ||
-    "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
 const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
 
+const hasValue = (value) =>
+    typeof value === "string" && value.trim().length > 0;
+
 export default async function ApiProxy(req, res) {
     var containerName = req.query.container;
-    var checkHash = req.query.hash;
 
-    if (typeof containerName === "undefined" || containerName.length === 0) {
+    if (!hasValue(containerName)) {
         return res.status(400).json();
     }
 
diff --git a/tests/phase16/service-behaviour.test.cjs b/tests/phase16/service-behaviour.test.cjs
new file mode 100644
index 00000000..467efa1f
--- /dev/null
+++ b/tests/phase16/service-behaviour.test.cjs
@@ -0,0 +1,147 @@
+const fs = require("fs");
+const path = require("path");
+const vm = require("vm");
+const assert = require("assert");
+
+const rootDir = path.resolve(__dirname, "..", "..");
+
+const loadModule = (relativePath, injected = {}) => {
+    const filePath = path.join(rootDir, relativePath);
+    let source = fs.readFileSync(filePath, "utf8");
+
+    source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
+    source = source.replace(
+        /export default async function\s+(\w+)\s*\(/,
+        "async function $1("
+    );
+    source = source.replace(/export const\s+/g, "const ");
+    source = source.replace(
+        /export default\s+(\w+);/g,
+        "module.exports.default = $1;"
+    );
+    source +=
+        '\nif (typeof ApiProxy !== "undefined" && !module.exports.default) module.exports.default = ApiProxy;\n';
+
+    const context = {
+        module: { exports: {} },
+        exports: {},
+        require,
+        process,
+        console: { log: () => {}, error: () => {} },
+        port: 3000,
+        ...injected
+    };
+
+    vm.runInNewContext(source, context, { filename: filePath });
+    return context.module.exports;
+};
+
+const createRes = () => {
+    const state = {
+        statusCode: null,
+        jsonBody: undefined,
+        sentBody: undefined,
+        headers: {}
+    };
+    return {
+        state,
+        status(code) {
+            state.statusCode = code;
+            return this;
+        },
+        json(payload) {
+            state.jsonBody = payload;
+            return payload;
+        },
+        send(payload) {
+            state.sentBody = payload;
+            return payload;
+        },
+        setHeader(name, value) {
+            state.headers[name] = value;
+        }
+    };
+};
+
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+test("getbloblistproxy rejects missing container with 400", async () => {
+    const mod = loadModule("pages/api/file/getbloblistproxy.js", {
+        getToken: async () => ({ access_token: "t" }),
+        hashAPIPath: () => "&hash=expected",
+        azureHeaders: () => ({}),
+        axios: { get: async () => ({ data: { ok: true } }) },
+        consoleLogger: () => {}
+    });
+
+    const req = { query: { casefolderID: "case-1" } };
+    const res = createRes();
+    await mod.default(req, res);
+    assert.strictEqual(res.state.statusCode, 400);
+});
+
+test("getrepsblobproxy rejects missing container with 400", async () => {
+    const mod = loadModule("pages/api/file/getrepsblobproxy.js", {
+        getToken: async () => ({ access_token: "t" }),
+        hashAPIPath: () => "&hash=expected",
+        azureHeaders: () => ({}),
+        axios: { get: async () => ({ data: { ok: true } }) },
+        consoleLogger: () => {}
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+    assert.strictEqual(res.state.statusCode, 400);
+});
+
+test("getawaitingsubmissionfromblobproxy rejects missing container with 400", async () => {
+    const mod = loadModule(
+        "pages/api/file/getawaitingsubmissionfromblobproxy.js",
+        {
+            getToken: async () => ({ access_token: "t" }),
+            hashAPIPath: () => "&hash=expected",
+            azureHeaders: () => ({}),
+            axios: { get: async () => ({ data: { ok: true } }) },
+            consoleLogger: () => {}
+        }
+    );
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+    assert.strictEqual(res.state.statusCode, 400);
+});
+
+test("getbloblistproxy valid input returns 200 with existing response shape", async () => {
+    const mod = loadModule("pages/api/file/getbloblistproxy.js", {
+        getToken: async () => ({ access_token: "t" }),
+        hashAPIPath: () => "&hash=expected",
+        azureHeaders: () => ({}),
+        axios: { get: async () => ({ data: [{ name: "a" }] }) },
+        consoleLogger: () => {}
+    });
+
+    const req = { query: { container: "c1", casefolderID: "case-1" } };
+    const res = createRes();
+    await mod.default(req, res);
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(res.state.jsonBody, [{ name: "a" }]);
+});
+
+const run = async () => {
+    let passed = 0;
+    for (const t of tests) {
+        await t.fn();
+        passed += 1;
+    }
+    console.log(
+        `Phase 16 behavioural tests passed (${passed}/${tests.length}).`
+    );
+};
+
+run().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});