diff --git a/components/admin/utils/serverside.js b/components/admin/utils/serverside.js
index 5db3ab4a..2f313c30 100644
--- a/components/admin/utils/serverside.js
+++ b/components/admin/utils/serverside.js
@@ -7,7 +7,7 @@ import { getUpToLastSlash, streamToString } from "../utils/adminHelper";
 import { listContainersForUser } from "../../../actions/azurestorage";
 
 const prisma = global.prisma || new PrismaClient();
-
+const WORDKEY = process.env.HASHKEY;
 /**
  * Generate HMAC hash for blob API link.
  */
diff --git a/memory-bank/activeContext.md b/memory-bank/activeContext.md
index 7776b830..6b28e99d 100644
--- a/memory-bank/activeContext.md
+++ b/memory-bank/activeContext.md
@@ -549,6 +549,83 @@
 - Applied small view-all presentation cleanup and watched-case refresh filtering adjustment.
 - Added missing `myportal` namespace mapping in `i18n.js` for `/newappeal/[appealtypes]`.
 
+## Phase 17 closeout status (2026-03-13)
+
+- Working branch created from `origin/SIPS-Development`:
+    - `TASK22057-phase17-hardening-closeout`
+- Completed remaining closeout hardening slice for sensitive file handlers:
+    - `pages/api/file/generatepdf.js`
+    - `pages/api/file/generateappealpdf.js`
+    - `pages/api/file/createappealcompletemessageproxy_api.js`
+- Applied consistency-only updates:
+    - standardized missing/invalid hash 400 negative paths in selected PDF handlers
+    - standardized required-input 400 guards where route contract requires it
+    - removed noisy direct logs from touched sensitive handlers
+    - preserved existing response shapes/signatures
+- Added focused behavioural coverage:
+    - `tests/phase17/service-behaviour.test.cjs` (6/6 passing)
+    - includes missing/invalid hash negative-path checks and valid-input proxy happy-path contract check
+- Broader consistency scan note:
+    - no additional broad hash/400 consistency gaps were identified in `pages/api/endpoint/**` in this pass.
+
+## Phase 18 additional consolidation slices (2026-03-14)
+
+- Continued on branch:
+    - `TASK22057-phase17-hardening-closeout`
+- Completed all three requested additional slices:
+    1. endpoint logging/input hygiene
+    2. file hash-guard flow consistency
+    3. create/update input-guard + logging hygiene
+- Touched handlers:
+    - `pages/api/endpoint/deletewatchedcases_api.js`
+    - `pages/api/endpoint/getaccounts_api.js`
+    - `pages/api/endpoint/getbasicsearchpaged_api.js`
+    - `pages/api/endpoint/getappealpdfdocuments_api.js`
+    - `pages/api/file/deleteblob.js`
+    - `pages/api/file/deleteawaitingsubmissionfromblob.js`
+    - `pages/api/file/getprogressobjblob.js`
+    - `pages/api/file/getbloblist.js`
+    - `pages/api/file/createcase_api.js`
+    - `pages/api/file/updatecase_api.js`
+    - `pages/api/file/editRepJson.js`
+- Outcome:
+    - consistent early 400 guard behavior for missing/invalid required inputs/hash in selected handlers
+    - noisy direct logs removed in touched sensitive flows
+    - no response-shape/signature contract changes intended
+- Added focused test pack:
+    - `tests/phase18/service-behaviour.test.cjs` (8/8 pass)
+
+## Phase 19 endpoint consistency slice (2026-03-14)
+
+- Continued on branch:
+    - `TASK22057-phase17-hardening-closeout`
+- Applied a small consistency-only slice across:
+    - `pages/api/endpoint/createwatchedcases_api.js`
+    - `pages/api/endpoint/getappealtypes_api.js`
+    - `pages/api/endpoint/getdnslist_api.js`
+- Scope:
+    - standardized missing/malformed required `@odata.bind` handling in `createwatchedcases_api` with early 400
+    - removed noisy query logging in appeal-types and dns-list endpoint handlers
+    - preserved response shapes/signatures
+- Added focused test file:
+    - `tests/phase19/service-behaviour.test.cjs` (5/5 pass)
+
+## Phase 20 endpoint consistency slice (2026-03-14)
+
+- Continued on branch:
+    - `TASK22057-phase17-hardening-closeout`
+- Applied a small consistency-only slice across:
+    - `pages/api/endpoint/getbasicdnssearch_api.js`
+    - `pages/api/endpoint/getbasicdnsurlsearch_api.js`
+    - `pages/api/endpoint/getbasicsearchdetailspaged_api.js`
+- Scope:
+    - removed noisy query logging in `getbasicdnssearch_api`
+    - added early 400 for missing/empty `searchString` in `getbasicdnsurlsearch_api`
+    - added early 400 for missing required params in `getbasicsearchdetailspaged_api`
+    - preserved response shapes/signatures
+- Added focused test file:
+    - `tests/phase20/service-behaviour.test.cjs` (5/5 pass)
+
 ## Likely next steps
 
 1. Stabilize and simplify breadcrumb/back-link decision logic with focused regression checks.
diff --git a/memory-bank/change-log.md b/memory-bank/change-log.md
index 2aafa659..2246687d 100644
--- a/memory-bank/change-log.md
+++ b/memory-bank/change-log.md
@@ -1112,3 +1112,193 @@ Validation:
 Follow-ups:
 
 - Keep delete calls consistently keyed on case reference across portal/view-all/top-three variants.
+
+---
+
+### CL-031: Phase 17 closeout — remaining sensitive file handler consistency hardening
+
+date: 2026-03-13
+author: Cline
+scope: `pages/api/file/{generatepdf,generateappealpdf,createappealcompletemessageproxy_api}.js`, `tests/phase17/service-behaviour.test.cjs`, `memory-bank/*`
+type: change
+rationale: Complete the remaining small hardening closeout slice in this stream by standardizing hash/input negative-path behavior and reducing noisy logging in the last priority-sensitive file handlers.
+impact: Consistent 400 behavior for missing/invalid hash and missing required inputs in selected handlers; preserved response shapes/signatures.
+status: completed
+
+Summary:
+
+- Branch created from `origin/SIPS-Development`: `TASK22057-phase17-hardening-closeout`.
+- Hardened:
+    - `generatepdf.js`
+    - `generateappealpdf.js`
+    - `createappealcompletemessageproxy_api.js`
+- Added early 400 guards for missing/invalid hash and required params where applicable.
+- Removed noisy direct logging in touched handlers.
+- Added focused test pack `tests/phase17/service-behaviour.test.cjs`.
+
+Validation:
+
+- `node tests/phase6/service-parity.test.cjs` -> pass
+- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> pass (12/12)
+- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
+- `node tests/phase14/service-behaviour.test.cjs` -> pass (9/9)
+- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase16/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase17/service-behaviour.test.cjs` -> pass (6/6)
+- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` warnings)
+
+Follow-ups:
+
+- If desired, run additional integrated HTTP/manual checks in an environment with full relay/storage dependencies for end-to-end happy-path confirmation beyond mocked behaviour tests.
+
+---
+
+### CL-032: Phase 18 additional consolidation slices — endpoint/file consistency and guard hygiene
+
+date: 2026-03-14
+author: Cline
+scope: `pages/api/endpoint/{deletewatchedcases_api,getaccounts_api,getbasicsearchpaged_api,getappealpdfdocuments_api}.js`, `pages/api/file/{deleteblob,deleteawaitingsubmissionfromblob,getprogressobjblob,getbloblist,createcase_api,updatecase_api,editRepJson}.js`, `tests/phase18/service-behaviour.test.cjs`, `memory-bank/*`
+type: change
+rationale: Complete the user-requested three additional small, reversible hardening slices (logging hygiene, hash-guard flow consistency, and required-input guard consistency) without broad refactor or contract drift.
+impact: Improves consistency of negative-path behavior and reduces noisy logging in selected sensitive handlers while preserving response/signature contracts.
+status: completed
+
+Summary:
+
+- Implemented all three requested additional slices:
+    1. endpoint logging/input hygiene
+    2. file hash-guard flow consistency
+    3. create/update input-guard + logging hygiene
+- Endpoint updates:
+    - `deletewatchedcases_api`: added required `watchedCaseID` early 400 guard and removed direct URL logging.
+    - `getaccounts_api`: added required `emailAddress` early 400 guard and removed direct query logging.
+    - `getbasicsearchpaged_api`: added required `searchString` early 400 guard and removed noisy query logging.
+    - `getappealpdfdocuments_api`: added required `incidentid` early 400 guard and removed direct URL logging.
+- File handler updates:
+    - standardized hash-check flow by removing redundant post-validation branches in:
+        - `deleteblob`
+        - `deleteawaitingsubmissionfromblob`
+        - `getprogressobjblob`
+        - `getbloblist`
+    - added required-input early 400 guards in:
+        - `createcase_api` (contact/appealType/container/lpa)
+        - `updatecase_api` (collection/appealObj/incident/body)
+    - removed noisy tag logging in `editRepJson`.
+- Added focused test pack:
+    - `tests/phase18/service-behaviour.test.cjs` with negative-path and contract-preserving happy-path checks (8/8 pass).
+
+Validation:
+
+- `node tests/phase6/service-parity.test.cjs` -> pass
+- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> pass (12/12)
+- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
+- `node tests/phase14/service-behaviour.test.cjs` -> pass (9/9)
+- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase16/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase17/service-behaviour.test.cjs` -> pass (6/6)
+- `node tests/phase18/service-behaviour.test.cjs` -> pass (8/8)
+- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` warnings)
+
+Follow-ups:
+
+- Optional: execute integrated manual HTTP matrix for phase-18 touched handlers in an environment with full relay/storage dependencies for non-mocked happy-path verification.
+
+---
+
+### CL-033: Phase 19 endpoint consistency slice — createwatchedcases guard hardening + noisy log cleanup
+
+date: 2026-03-14
+author: Cline
+scope: `pages/api/endpoint/{createwatchedcases_api,getappealtypes_api,getdnslist_api}.js`, `tests/phase19/service-behaviour.test.cjs`, `memory-bank/*`
+type: change
+rationale: Deliver a small reversible consistency-only slice for selected sensitive endpoint handlers by standardizing invalid required input handling and removing noisy logging without changing contracts.
+impact: Improves negative-path consistency and logging hygiene for selected handlers; response signatures/shapes preserved.
+status: completed
+
+Summary:
+
+- `createwatchedcases_api` now consistently rejects missing/malformed required `@odata.bind` values with early 400.
+- Removed noisy query URL logging in:
+    - `getappealtypes_api`
+    - `getdnslist_api`
+- Added focused behavioural test pack:
+    - `tests/phase19/service-behaviour.test.cjs` (5 tests)
+
+Validation:
+
+- `node tests/phase6/service-parity.test.cjs` -> pass
+- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> pass (12/12)
+- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
+- `node tests/phase14/service-behaviour.test.cjs` -> pass (9/9)
+- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase16/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase17/service-behaviour.test.cjs` -> pass (6/6)
+- `node tests/phase18/service-behaviour.test.cjs` -> pass (8/8)
+- `node tests/phase19/service-behaviour.test.cjs` -> pass (5/5)
+- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
+
+Follow-ups:
+
+- Continue same small-batch consistency pattern for remaining sensitive endpoint handlers only where clear guard/logging drift exists.
+
+---
+
+### CL-034: Phase 20 endpoint consistency slice — dns/basic-search guard + logging cleanup
+
+date: 2026-03-14
+author: Cline
+scope: `pages/api/endpoint/{getbasicdnssearch_api,getbasicdnsurlsearch_api,getbasicsearchdetailspaged_api}.js`, `tests/phase20/service-behaviour.test.cjs`, `memory-bank/*`
+type: change
+rationale: Deliver a small reversible consistency-only slice by removing noisy logging and standardizing required-input negative-path handling in additional sensitive endpoint handlers.
+impact: Improves endpoint negative-path consistency and logging hygiene while preserving response signatures/shapes.
+status: completed
+
+Summary:
+
+- Removed noisy `console.log` query logging in `getbasicdnssearch_api`.
+- Added early 400 handling for missing/empty `searchString` in `getbasicdnsurlsearch_api`.
+- Added early 400 handling for missing required params (`appealTypeName`, `primaryIdAttribute`, `incidentID`) in `getbasicsearchdetailspaged_api`.
+- Added focused behavioural test pack:
+    - `tests/phase20/service-behaviour.test.cjs` (5 tests)
+
+Validation:
+
+- `node tests/phase6/service-parity.test.cjs` -> pass
+- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> pass (12/12)
+- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
+- `node tests/phase14/service-behaviour.test.cjs` -> pass (9/9)
+- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase16/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase17/service-behaviour.test.cjs` -> pass (6/6)
+- `node tests/phase18/service-behaviour.test.cjs` -> pass (8/8)
+- `node tests/phase19/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase20/service-behaviour.test.cjs` -> pass (5/5)
+- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
+
+Follow-ups:
+
+- Continue same small-batch consistency pattern for remaining endpoint handlers where required-input/logging drift is clear.
diff --git a/memory-bank/progress.md b/memory-bank/progress.md
index 6075ffef..4d330a1d 100644
--- a/memory-bank/progress.md
+++ b/memory-bank/progress.md
@@ -623,6 +623,76 @@
 - `node tests/phase15/service-behaviour.test.cjs` -> **pass** (5/5)
 - `npm run lint` -> **warnings only** (pre-existing `react-hooks/exhaustive-deps` warnings)
 
+## Latest update (2026-03-14 — Phase 19 endpoint consistency slice)
+
+- Continued on branch:
+    - `TASK22057-phase17-hardening-closeout`
+- Delivered a small additional consistency-only endpoint slice across:
+    - `pages/api/endpoint/createwatchedcases_api.js`
+    - `pages/api/endpoint/getappealtypes_api.js`
+    - `pages/api/endpoint/getdnslist_api.js`
+- Scope delivered:
+    - added required early 400 handling for malformed/missing `@odata.bind` values in `createwatchedcases_api`
+    - removed noisy query logging in `getappealtypes_api` and `getdnslist_api`
+    - preserved response-shape/signature contracts
+- Added focused tests:
+    - `tests/phase19/service-behaviour.test.cjs` (5/5 passing)
+
+### Validation snapshot (Phase 19)
+
+- `node tests/phase6/service-parity.test.cjs` -> **pass**
+- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (12/12)
+- `node tests/phase8/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase10/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase11/service-behaviour.test.cjs` -> **pass** (4/4)
+- `node tests/phase12/service-behaviour.test.cjs` -> **pass** (4/4)
+- `node tests/phase13/service-behaviour.test.cjs` -> **pass** (7/7)
+- `node tests/phase14/service-behaviour.test.cjs` -> **pass** (9/9)
+- `node tests/phase15/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase16/service-behaviour.test.cjs` -> **pass** (4/4)
+- `node tests/phase17/service-behaviour.test.cjs` -> **pass** (6/6)
+- `node tests/phase18/service-behaviour.test.cjs` -> **pass** (8/8)
+- `node tests/phase19/service-behaviour.test.cjs` -> **pass** (5/5)
+- `npm run lint` -> **warnings only** (pre-existing `react-hooks/exhaustive-deps` warnings)
+
+## Latest update (2026-03-14 — Phase 20 endpoint consistency slice)
+
+- Continued on branch:
+    - `TASK22057-phase17-hardening-closeout`
+- Delivered a small additional consistency-only endpoint slice across:
+    - `pages/api/endpoint/getbasicdnssearch_api.js`
+    - `pages/api/endpoint/getbasicdnsurlsearch_api.js`
+    - `pages/api/endpoint/getbasicsearchdetailspaged_api.js`
+- Scope delivered:
+    - removed noisy query logging in `getbasicdnssearch_api`
+    - standardized missing/empty `searchString` handling in `getbasicdnsurlsearch_api` with early 400
+    - standardized missing required input handling in `getbasicsearchdetailspaged_api` (`appealTypeName`, `primaryIdAttribute`, `incidentID`) with early 400
+    - preserved response-shape/signature contracts
+- Added focused tests:
+    - `tests/phase20/service-behaviour.test.cjs` (5/5 passing)
+
+### Validation snapshot (Phase 20)
+
+- `node tests/phase6/service-parity.test.cjs` -> **pass**
+- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (12/12)
+- `node tests/phase8/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase10/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase11/service-behaviour.test.cjs` -> **pass** (4/4)
+- `node tests/phase12/service-behaviour.test.cjs` -> **pass** (4/4)
+- `node tests/phase13/service-behaviour.test.cjs` -> **pass** (7/7)
+- `node tests/phase14/service-behaviour.test.cjs` -> **pass** (9/9)
+- `node tests/phase15/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase16/service-behaviour.test.cjs` -> **pass** (4/4)
+- `node tests/phase17/service-behaviour.test.cjs` -> **pass** (6/6)
+- `node tests/phase18/service-behaviour.test.cjs` -> **pass** (8/8)
+- `node tests/phase19/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase20/service-behaviour.test.cjs` -> **pass** (5/5)
+- `npm run lint` -> **warnings only** (pre-existing `react-hooks/exhaustive-deps` warnings)
+
 ### Manual HTTP snapshot (Phase 15)
 
 - Dev server run on `http://localhost:3002`.
diff --git a/memory-bank/refactor-plan-actions-index.md b/memory-bank/refactor-plan-actions-index.md
index 31881604..babd2760 100644
--- a/memory-bank/refactor-plan-actions-index.md
+++ b/memory-bank/refactor-plan-actions-index.md
@@ -577,6 +577,140 @@ Status key: `[x] done`, `[ ] pending`
 
 - Revert commit `d32d7d0` to restore prior myportal/i18n state.
 
+### Phase 17 closeout snapshot (2026-03-13)
+
+Status key: `[x] done`, `[ ] pending`
+
+1. `[x]` Create new branch from `origin/SIPS-Development` with required work item prefix
+    - branch: `TASK22057-phase17-hardening-closeout`
+2. `[x]` Complete remaining consistency-only hardening targets in `pages/api/file/**`
+    - `pages/api/file/generatepdf.js`
+    - `pages/api/file/generateappealpdf.js`
+    - `pages/api/file/createappealcompletemessageproxy_api.js`
+3. `[x]` Standardize negative-path behavior and logging discipline
+    - explicit early 400 guards for missing/invalid hash where applicable
+    - explicit early 400 guards for missing required params where applicable
+    - noisy direct logs removed from touched handlers
+    - response-shape/signature contracts preserved
+4. `[x]` Add focused Phase 17 tests
+    - added `tests/phase17/service-behaviour.test.cjs`
+    - includes missing/invalid hash negative-path checks
+    - includes missing required-param checks
+    - includes valid-input happy-path check for proxy contract
+5. `[x]` Execute required validation bundle
+    - phase6 parity + phase6–phase17 behaviour tests -> pass
+    - lint -> warnings only (pre-existing)
+6. `[x]` Consistency scan for remaining `pages/api/**`
+    - no additional broad hash/400 consistency gaps identified in `pages/api/endpoint/**` during this pass
+
+### Phase 17 rollback notes
+
+- Revert these files to rollback the full closeout slice:
+    - `pages/api/file/generatepdf.js`
+    - `pages/api/file/generateappealpdf.js`
+    - `pages/api/file/createappealcompletemessageproxy_api.js`
+    - `tests/phase17/service-behaviour.test.cjs`
+- Re-run phase6–phase17 baseline tests and lint after rollback to confirm parity.
+
+### Phase 18 additional consolidation slices snapshot (2026-03-14)
+
+Status key: `[x] done`, `[ ] pending`
+
+1. `[x]` Confirm requested scope expansion to implement all 3 additional slices
+2. `[x]` Apply endpoint logging/input hygiene slice
+    - `pages/api/endpoint/deletewatchedcases_api.js`
+    - `pages/api/endpoint/getaccounts_api.js`
+    - `pages/api/endpoint/getbasicsearchpaged_api.js`
+    - `pages/api/endpoint/getappealpdfdocuments_api.js`
+3. `[x]` Apply file hash-guard flow consistency slice
+    - `pages/api/file/deleteblob.js`
+    - `pages/api/file/deleteawaitingsubmissionfromblob.js`
+    - `pages/api/file/getprogressobjblob.js`
+    - `pages/api/file/getbloblist.js`
+4. `[x]` Apply create/update input-guard + logging hygiene slice
+    - `pages/api/file/createcase_api.js`
+    - `pages/api/file/updatecase_api.js`
+    - `pages/api/file/editRepJson.js`
+5. `[x]` Add focused phase-18 behavioural tests
+    - added `tests/phase18/service-behaviour.test.cjs`
+    - negative-path coverage for required inputs/hash
+    - contract-preserving happy-path checks on selected handlers
+6. `[x]` Execute validation bundle
+    - phase6 parity + phase6–phase18 behavioural tests all pass
+    - lint warnings only (pre-existing `react-hooks/exhaustive-deps` set)
+
+### Phase 18 rollback notes
+
+- Revert files in this slice:
+    - `pages/api/endpoint/deletewatchedcases_api.js`
+    - `pages/api/endpoint/getaccounts_api.js`
+    - `pages/api/endpoint/getbasicsearchpaged_api.js`
+    - `pages/api/endpoint/getappealpdfdocuments_api.js`
+    - `pages/api/file/deleteblob.js`
+    - `pages/api/file/deleteawaitingsubmissionfromblob.js`
+    - `pages/api/file/getprogressobjblob.js`
+    - `pages/api/file/getbloblist.js`
+    - `pages/api/file/createcase_api.js`
+    - `pages/api/file/updatecase_api.js`
+    - `pages/api/file/editRepJson.js`
+    - `tests/phase18/service-behaviour.test.cjs`
+- Re-run phase6–phase18 baseline tests and lint after rollback to confirm parity.
+
+### Phase 19 endpoint consistency slice snapshot (2026-03-14)
+
+Status key: `[x] done`, `[ ] pending`
+
+1. `[x]` Apply small consistency-only endpoint hardening in selected handlers
+    - `pages/api/endpoint/createwatchedcases_api.js`
+    - `pages/api/endpoint/getappealtypes_api.js`
+    - `pages/api/endpoint/getdnslist_api.js`
+2. `[x]` Standardize negative-path required input handling
+    - early 400 on missing/malformed required `@odata.bind` values in `createwatchedcases_api`
+3. `[x]` Remove noisy sensitive-path logging
+    - removed direct query logging in appeal-types and dns-list handlers
+4. `[x]` Add focused tests
+    - `tests/phase19/service-behaviour.test.cjs` (5/5)
+5. `[x]` Execute validation bundle
+    - phase6 parity + phase6–phase19 behavioural suites pass
+    - lint warnings only (pre-existing)
+
+### Phase 19 rollback notes
+
+- Revert files in this slice:
+    - `pages/api/endpoint/createwatchedcases_api.js`
+    - `pages/api/endpoint/getappealtypes_api.js`
+    - `pages/api/endpoint/getdnslist_api.js`
+    - `tests/phase19/service-behaviour.test.cjs`
+- Re-run phase6–phase19 baseline tests and lint after rollback.
+
+### Phase 20 endpoint consistency slice snapshot (2026-03-14)
+
+Status key: `[x] done`, `[ ] pending`
+
+1. `[x]` Apply small consistency-only endpoint hardening in selected handlers
+    - `pages/api/endpoint/getbasicdnssearch_api.js`
+    - `pages/api/endpoint/getbasicdnsurlsearch_api.js`
+    - `pages/api/endpoint/getbasicsearchdetailspaged_api.js`
+2. `[x]` Standardize negative-path required input handling
+    - early 400 for missing/empty `searchString` in `getbasicdnsurlsearch_api`
+    - early 400 for missing required params in `getbasicsearchdetailspaged_api`
+3. `[x]` Remove noisy sensitive-path logging
+    - removed direct query logging in `getbasicdnssearch_api`
+4. `[x]` Add focused tests
+    - `tests/phase20/service-behaviour.test.cjs` (5/5)
+5. `[x]` Execute validation bundle
+    - phase6 parity + phase6–phase20 behavioural suites pass
+    - lint warnings only (pre-existing)
+
+### Phase 20 rollback notes
+
+- Revert files in this slice:
+    - `pages/api/endpoint/getbasicdnssearch_api.js`
+    - `pages/api/endpoint/getbasicdnsurlsearch_api.js`
+    - `pages/api/endpoint/getbasicsearchdetailspaged_api.js`
+    - `tests/phase20/service-behaviour.test.cjs`
+- Re-run phase6–phase20 baseline tests and lint after rollback.
+
 ## Safe execution mode for migration chunks (required)
 
 To reduce terminal hangs during bulk migration work, run refactor chunks in **safe stepwise mode** instead of long chained commands.
diff --git a/pages/api/admin/getlatestdocuments_api.js b/pages/api/admin/getlatestdocuments_api.js
index f2b758ea..d9b6b622 100644
--- a/pages/api/admin/getlatestdocuments_api.js
+++ b/pages/api/admin/getlatestdocuments_api.js
@@ -21,26 +21,13 @@ import _ from "lodash";
 import { azureHeadersPagedCustom } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-import { number } from "prop-types";
-
+import { hashAPIPath } from "../../../actions/core/hash";
 const WORDKEY = process.env.HASHKEY;
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 const encryptDocReference = (documentRef) => {
     var hashlink = CryptoJS.HmacSHA256(
         "documents/download/" + documentRef,
diff --git a/pages/api/admin/getnewappeals_api.js b/pages/api/admin/getnewappeals_api.js
index d6669c3d..2ab64f48 100644
--- a/pages/api/admin/getnewappeals_api.js
+++ b/pages/api/admin/getnewappeals_api.js
@@ -21,25 +21,12 @@ import _ from "lodash";
 import { azureHeadersPagedCustom } from "../../../actions/core/headers";
 import { getToken } from "../../../actions/core/token";
 import { consoleLogger } from "../../../actions/core/logger";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var searchString = req.query.searchString;
     var pageNumber = req.query.pageNumber || 1;
diff --git a/pages/api/email/getall.js b/pages/api/email/getall.js
index 088145d6..d423a303 100644
--- a/pages/api/email/getall.js
+++ b/pages/api/email/getall.js
@@ -5,6 +5,7 @@ import { azureHeaders, azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 import { formatDates } from "../../../components/utils";
+import { hashAPIPath } from "../../../actions/core/hash";
 
 var NotifyClient = require("notifications-node-client").NotifyClient;
 
@@ -15,14 +16,6 @@ const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    const hash = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    ).toString(CryptoJS.enc.Hex);
-    return queryPath.includes("?") ? `&hash=${hash}` : `?hash=${hash}`;
-};
-
 const encryptDocReference = (documentRef) => {
     const hash = CryptoJS.HmacSHA256(
         `documents/download/${documentRef}`,
diff --git a/pages/api/email/getcaseref.js b/pages/api/email/getcaseref.js
index 53f23f50..ab259902 100644
--- a/pages/api/email/getcaseref.js
+++ b/pages/api/email/getcaseref.js
@@ -4,25 +4,12 @@ import _ from "lodash";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 function flattenWatchlistEntry(entry) {
     const flattened = { ...entry };
 
diff --git a/pages/api/email/getdocuments.js b/pages/api/email/getdocuments.js
index 7201195c..781d74cb 100644
--- a/pages/api/email/getdocuments.js
+++ b/pages/api/email/getdocuments.js
@@ -4,23 +4,13 @@ import _ from "lodash";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WORDKEY = process.env.HASHKEY;
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-/**
- * Generates a hash-secured query string.
- */
-const hashAPIPath = (queryPath) => {
-    const hash = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    ).toString(CryptoJS.enc.Hex);
-    return queryPath.includes("?") ? `&hash=${hash}` : `?hash=${hash}`;
-};
-
 /**
  * Encrypts a document reference into a secure hash link.
  */
diff --git a/pages/api/email/getevents.js b/pages/api/email/getevents.js
index b66456ea..75fc8e50 100644
--- a/pages/api/email/getevents.js
+++ b/pages/api/email/getevents.js
@@ -4,24 +4,13 @@ import _ from "lodash";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WORDKEY = process.env.HASHKEY;
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-/**
- * Generate hashed query string for secured API access.
- */
-const hashAPIPath = (queryPath) => {
-    const hash = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    ).toString(CryptoJS.enc.Hex);
-
-    return queryPath.includes("?") ? `&hash=${hash}` : `?hash=${hash}`;
-};
-
 /**
  * Main proxy handler.
  */
diff --git a/pages/api/email/getmailinglist.js b/pages/api/email/getmailinglist.js
index 14a6ecda..3aaebd3d 100644
--- a/pages/api/email/getmailinglist.js
+++ b/pages/api/email/getmailinglist.js
@@ -4,6 +4,7 @@ import _ from "lodash";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WORDKEY = process.env.HASHKEY;
 
@@ -11,18 +12,6 @@ const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 function flattenWatchlistEntry(entry) {
     const flattened = { ...entry };
 
diff --git a/pages/api/endpoint/createaccount_api.js b/pages/api/endpoint/createaccount_api.js
index d2aa587d..8c8468c8 100644
--- a/pages/api/endpoint/createaccount_api.js
+++ b/pages/api/endpoint/createaccount_api.js
@@ -14,25 +14,12 @@ import axios from "axios";
 import CryptoJS from "crypto-js";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var token = await getToken();
     var queryUrl = "contacts";
diff --git a/pages/api/endpoint/createcase_api.js b/pages/api/endpoint/createcase_api.js
index ee4ba35f..fcee4bf6 100644
--- a/pages/api/endpoint/createcase_api.js
+++ b/pages/api/endpoint/createcase_api.js
@@ -46,24 +46,12 @@ import CryptoJS from "crypto-js";
 import _ from "lodash";
 import { getToken } from "../../../actions/core/token";
 import { getCaseBlob } from "../../../actions/azurestorage";
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var createCaseBody = req.body;
     var contactid = req.query.contactid;
diff --git a/pages/api/endpoint/createcrmtask_api.js b/pages/api/endpoint/createcrmtask_api.js
index 72f7efb5..37dca717 100644
--- a/pages/api/endpoint/createcrmtask_api.js
+++ b/pages/api/endpoint/createcrmtask_api.js
@@ -48,24 +48,12 @@ import { isNonEmptyString, sanitizeString } from "../../../actions/core/guards";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 import { getCaseBlob } from "../../../actions/azurestorage";
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var createTaskBody = req.body;
 
diff --git a/pages/api/endpoint/createwatchedcases_api.js b/pages/api/endpoint/createwatchedcases_api.js
index 56f05b14..b1092ef4 100644
--- a/pages/api/endpoint/createwatchedcases_api.js
+++ b/pages/api/endpoint/createwatchedcases_api.js
@@ -14,25 +14,12 @@ import axios from "axios";
 import CryptoJS from "crypto-js";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 // export default async function ApiProxy(req, res) {
 //     var token = await getToken();
 //     var data = JSON.stringify(req.body);
@@ -86,12 +73,30 @@ const recordExists = async (incidentId, contactId, token) => {
 };
 
 export default async function ApiProxy(req, res) {
-    const token = await getToken();
     const data = req.body;
+    const watchedCaseBind = data?.["pinswg_WatchedCase@odata.bind"];
+    const contactBind = data?.["pinswg_Contact@odata.bind"];
 
-    const incidentId =
-        data["pinswg_WatchedCase@odata.bind"].match(/\(([^)]+)\)/)[1];
-    const contactId = data["pinswg_Contact@odata.bind"].match(/\(([^)]+)\)/)[1];
+    if (
+        typeof watchedCaseBind !== "string" ||
+        watchedCaseBind.length === 0 ||
+        typeof contactBind !== "string" ||
+        contactBind.length === 0
+    ) {
+        return res.status(400).json();
+    }
+
+    const watchedCaseMatch = watchedCaseBind.match(/\(([^)]+)\)/);
+    const contactMatch = contactBind.match(/\(([^)]+)\)/);
+
+    if (!watchedCaseMatch || !contactMatch) {
+        return res.status(400).json();
+    }
+
+    const token = await getToken();
+
+    const incidentId = watchedCaseMatch[1];
+    const contactId = contactMatch[1];
 
     const existingRecord = await recordExists(incidentId, contactId, token);
 
diff --git a/pages/api/endpoint/deleteawaitingsubmissions_api.js b/pages/api/endpoint/deleteawaitingsubmissions_api.js
index 23189625..64b8d0b6 100644
--- a/pages/api/endpoint/deleteawaitingsubmissions_api.js
+++ b/pages/api/endpoint/deleteawaitingsubmissions_api.js
@@ -14,25 +14,12 @@ import axios from "axios";
 import CryptoJS from "crypto-js";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var incidentID = req.query.incidentID;
     var token = await getToken();
diff --git a/pages/api/endpoint/deletemyrepresentations_api.js b/pages/api/endpoint/deletemyrepresentations_api.js
index b0c6fadf..aff512fe 100644
--- a/pages/api/endpoint/deletemyrepresentations_api.js
+++ b/pages/api/endpoint/deletemyrepresentations_api.js
@@ -15,24 +15,12 @@ import CryptoJS from "crypto-js";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var myRepresentationsID = req.query.myRepresentationsID;
     var token = await getToken();
diff --git a/pages/api/endpoint/deletewatchedcases_api.js b/pages/api/endpoint/deletewatchedcases_api.js
index e569e72a..3972ccff 100644
--- a/pages/api/endpoint/deletewatchedcases_api.js
+++ b/pages/api/endpoint/deletewatchedcases_api.js
@@ -14,32 +14,22 @@ import axios from "axios";
 import CryptoJS from "crypto-js";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var watchedCaseID = req.query.watchedCaseID;
+
+    if (typeof watchedCaseID === "undefined" || watchedCaseID.length === 0) {
+        return res.status(400).json();
+    }
+
     var token = await getToken();
     var queryUrl = "pinswg_watchlists(" + watchedCaseID + ")";
 
-    console.log(WEBAPI_URL + queryUrl + hashAPIPath(queryUrl));
-
     var config = {
         method: "delete",
         url: WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
diff --git a/pages/api/endpoint/getaccounts_api.js b/pages/api/endpoint/getaccounts_api.js
index d960601a..681e5895 100644
--- a/pages/api/endpoint/getaccounts_api.js
+++ b/pages/api/endpoint/getaccounts_api.js
@@ -21,24 +21,19 @@ import _ from "lodash";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var emailAddress = req.query.emailAddress;
+
+    if (typeof emailAddress === "undefined" || emailAddress.length === 0) {
+        return res.status(400).json();
+    }
+
     var token = await getToken();
 
     var queryUrl =
@@ -46,25 +41,24 @@ export default async function ApiProxy(req, res) {
         emailAddress +
         "'&$count=true&$select=emailaddress1, contactid";
 
-    console.log(queryUrl);
     // var queryUrl = "contacts/?$count=true&$select=emailaddress1, contactid";
 
     var apiResponse = _.isEmpty(req.query)
         ? res.status(400).json()
         : typeof emailAddress != "undefined" && emailAddress.length > 0
-        ? axios
-              .get(
-                  WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-                  azureHeaders(token.access_token)
-              )
-              .then(({ data }) => {
-                  res.status(200).json(data);
-              })
-              .catch((error) => {
-                  consoleLogger(error);
-                  res.status(400).json(error);
-              })
-        : res.status(400).json();
+          ? axios
+                .get(
+                    WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
+                    azureHeaders(token.access_token)
+                )
+                .then(({ data }) => {
+                    res.status(200).json(data);
+                })
+                .catch((error) => {
+                    consoleLogger(error);
+                    res.status(400).json(error);
+                })
+          : res.status(400).json();
 
     return apiResponse;
 }
diff --git a/pages/api/endpoint/getadvancedsearch_api.js b/pages/api/endpoint/getadvancedsearch_api.js
index f0f3a5c8..77b09fe7 100644
--- a/pages/api/endpoint/getadvancedsearch_api.js
+++ b/pages/api/endpoint/getadvancedsearch_api.js
@@ -27,25 +27,12 @@ import _ from "lodash";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var searchString = req.query.searchstring;
     var token = await getToken();
diff --git a/pages/api/endpoint/getadvancedsearchpaged_api.js b/pages/api/endpoint/getadvancedsearchpaged_api.js
index 424047ba..1422f748 100644
--- a/pages/api/endpoint/getadvancedsearchpaged_api.js
+++ b/pages/api/endpoint/getadvancedsearchpaged_api.js
@@ -57,25 +57,12 @@ import {
 } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var searchString = req.query.searchstring;
     var pageNumber = req.query.pageNumber;
diff --git a/pages/api/endpoint/getappealid_api.js b/pages/api/endpoint/getappealid_api.js
index b43217a2..ed1fefd8 100644
--- a/pages/api/endpoint/getappealid_api.js
+++ b/pages/api/endpoint/getappealid_api.js
@@ -33,22 +33,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var caseReference = req.query.caseReference;
     var updateFormCollection = req.query.updateFormCollection;
diff --git a/pages/api/endpoint/getappealpdfdocuments_api.js b/pages/api/endpoint/getappealpdfdocuments_api.js
index 2da5265d..7579ed32 100644
--- a/pages/api/endpoint/getappealpdfdocuments_api.js
+++ b/pages/api/endpoint/getappealpdfdocuments_api.js
@@ -21,25 +21,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 const groupArray = (arr) => {
     const map = new Map();
 
@@ -60,7 +47,7 @@ const groupArray = (arr) => {
                 obj[
                     "pinswg_isharedocumentlocations@OData.Community.Display.V1.FormattedValue"
                 ], // Change 'name' to 'userName'
-            count: count, // Add 'count' as 'occurrences'
+            count: count // Add 'count' as 'occurrences'
         };
 
         result.push(transformedObj);
@@ -71,6 +58,11 @@ const groupArray = (arr) => {
 
 export default async function ApiProxy(req, res) {
     var incidentID = req.query.incidentid;
+
+    if (typeof incidentID === "undefined" || incidentID.length === 0) {
+        return res.status(400).json();
+    }
+
     var token = await getToken();
 
     var queryUrl =
@@ -78,8 +70,6 @@ export default async function ApiProxy(req, res) {
         incidentID +
         " and not(contains(pinswg_name,'_Appeal_Form.pdf'))&$select=pinswg_name,pinswg_isharedocumentlocations";
 
-    console.log("docu: ", WEBAPI_URL + queryUrl + hashAPIPath(queryUrl));
-
     return axios
         .get(
             WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
diff --git a/pages/api/endpoint/getappealtypes_api.js b/pages/api/endpoint/getappealtypes_api.js
index 24a81c7d..dec3d896 100644
--- a/pages/api/endpoint/getappealtypes_api.js
+++ b/pages/api/endpoint/getappealtypes_api.js
@@ -14,25 +14,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var token = await getToken();
 
@@ -49,8 +36,6 @@ export default async function ApiProxy(req, res) {
     // "stringmaps?$filter=objecttypecode eq 'incident' and attributename eq 'pinswg_appealcasetype' and value ne 'Misc Casework'&$count=true&$select=value,stringmapid,organizationid,attributevalue&$orderby=value asc";
     //"stringmaps?$filter=objecttypecode eq 'incident' and attributename eq 'pinswg_appealcasetype' and value ne 'Developments of National Significance' and value ne 'LDP' and value ne 'Misc Casework'&$count=true&$select=value,stringmapid,organizationid,attributevalue&$orderby=value asc";
 
-    console.log(queryUrl);
-
     return axios
         .get(
             WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
diff --git a/pages/api/endpoint/getawaitingsubmission_api.js b/pages/api/endpoint/getawaitingsubmission_api.js
index 110952aa..05339feb 100644
--- a/pages/api/endpoint/getawaitingsubmission_api.js
+++ b/pages/api/endpoint/getawaitingsubmission_api.js
@@ -22,22 +22,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var loggedInUserId = req.query.loggedInUserId;
     var token = await getToken();
diff --git a/pages/api/endpoint/getawaitingsubmissionproxy_api.js b/pages/api/endpoint/getawaitingsubmissionproxy_api.js
index 02ff305d..206680bf 100644
--- a/pages/api/endpoint/getawaitingsubmissionproxy_api.js
+++ b/pages/api/endpoint/getawaitingsubmissionproxy_api.js
@@ -15,22 +15,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var loggedInUserId = req.query.loggedInUserId;
     var token = await getToken();
diff --git a/pages/api/endpoint/getbasicdnssearch_api.js b/pages/api/endpoint/getbasicdnssearch_api.js
index f947ebf7..82a18e29 100644
--- a/pages/api/endpoint/getbasicdnssearch_api.js
+++ b/pages/api/endpoint/getbasicdnssearch_api.js
@@ -22,33 +22,18 @@ import _ from "lodash";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var token = await getToken();
 
     var queryUrl =
         "incidents?$select=pinswg_environmentalstatementlocation,pinswg_caseaddress,modifiedon,description,numberofchildincidents,_accountid_value,_customerid_value,_pinswg_associatedlpa_value,_ownerid_value,pinswg_appealcasetype,statuscode,ticketnumber,title, _primarycontactid_value,pinswg_lpareference&$expand=primarycontactid($select=fullname)&$filter=(pinswg_appealcasetype eq 846040011 or pinswg_appealcasetype eq 846040002)and pinswg_publishtoweb eq true&$orderby=createdon desc&$count=true";
 
-    console.log(queryUrl);
-
     return axios
         .get(
             WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
diff --git a/pages/api/endpoint/getbasicdnssearchdetails_api.js b/pages/api/endpoint/getbasicdnssearchdetails_api.js
index 3c9876c4..7bd99f7c 100644
--- a/pages/api/endpoint/getbasicdnssearchdetails_api.js
+++ b/pages/api/endpoint/getbasicdnssearchdetails_api.js
@@ -16,25 +16,12 @@ import _ from "lodash";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 import { getSelectQuery } from "../../../actions/selectQueryTypes";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var caseReference = req.query.caseReference;
     var token = await getToken();
@@ -50,19 +37,19 @@ export default async function ApiProxy(req, res) {
     var apiResponse = _.isEmpty(req.query)
         ? res.status(400).json()
         : typeof caseReference != "undefined" && caseReference.length > 0
-        ? axios
-              .get(
-                  WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-                  azureHeaders(token.access_token)
-              )
-              .then(({ data }) => {
-                  res.status(200).json(data);
-              })
-              .catch((error) => {
-                  consoleLogger(error);
-                  res.status(400).json(error);
-              })
-        : res.status(400).json();
+          ? axios
+                .get(
+                    WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
+                    azureHeaders(token.access_token)
+                )
+                .then(({ data }) => {
+                    res.status(200).json(data);
+                })
+                .catch((error) => {
+                    consoleLogger(error);
+                    res.status(400).json(error);
+                })
+          : res.status(400).json();
 
     return apiResponse;
 }
diff --git a/pages/api/endpoint/getbasicdnssearchdetailspaged_api.js b/pages/api/endpoint/getbasicdnssearchdetailspaged_api.js
index 982d4036..fd87438b 100644
--- a/pages/api/endpoint/getbasicdnssearchdetailspaged_api.js
+++ b/pages/api/endpoint/getbasicdnssearchdetailspaged_api.js
@@ -16,25 +16,12 @@ import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 import { getSelectQuery } from "../../../actions/selectQueryTypes";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var caseReference = req.query.caseReference;
     var token = await getToken();
@@ -50,23 +37,23 @@ export default async function ApiProxy(req, res) {
     var apiResponse = _.isEmpty(req.query)
         ? res.status(400).json()
         : typeof caseReference != "undefined" && caseReference.length > 0
-        ? axios
-              .get(
-                  WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-                  azureHeadersPaged(token.access_token)
-              )
-              .then(({ data }) => {
-                  var dataStr;
-                  _.has(data, "@odata.nextLink") == true &&
-                      ((dataStr = JSON.stringify(data["@odata.nextLink"])),
-                      (data["@odata.nextLink"] = dataStr.split("/v8.2/")[1]));
-                  return res.status(200).json(data);
-              })
-              .catch((error) => {
-                  consoleLogger(error);
-                  res.status(400).json(error);
-              })
-        : res.status(400).json();
+          ? axios
+                .get(
+                    WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
+                    azureHeadersPaged(token.access_token)
+                )
+                .then(({ data }) => {
+                    var dataStr;
+                    _.has(data, "@odata.nextLink") == true &&
+                        ((dataStr = JSON.stringify(data["@odata.nextLink"])),
+                        (data["@odata.nextLink"] = dataStr.split("/v8.2/")[1]));
+                    return res.status(200).json(data);
+                })
+                .catch((error) => {
+                    consoleLogger(error);
+                    res.status(400).json(error);
+                })
+          : res.status(400).json();
 
     return apiResponse;
 }
diff --git a/pages/api/endpoint/getbasicdnsurlsearch_api.js b/pages/api/endpoint/getbasicdnsurlsearch_api.js
index 1e0e2383..b4286ceb 100644
--- a/pages/api/endpoint/getbasicdnsurlsearch_api.js
+++ b/pages/api/endpoint/getbasicdnsurlsearch_api.js
@@ -22,27 +22,19 @@ import _ from "lodash";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var searchString = req.query.searchString;
+
+    if (!searchString || String(searchString).trim().length === 0) {
+        return res.status(400).json();
+    }
+
     var token = await getToken();
 
     searchString = searchString.replace(/\'/g, "''");
@@ -54,28 +46,26 @@ export default async function ApiProxy(req, res) {
         searchString +
         "')) and (pinswg_appealcasetype eq 846040011 or pinswg_appealcasetype eq 846040002 ) and pinswg_publishtoweb eq true&$orderby=createdon desc&$count=true";
 
-    console.log("basic search ", queryUrl);
-
     var apiResponse = _.isEmpty(req.query)
         ? res.status(400).json()
         : searchString.length > 0
-        ? axios
-              .get(
-                  WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-                  azureHeadersPaged(token.access_token)
-              )
-              .then(({ data }) => {
-                  var dataStr;
-                  _.has(data, "@odata.nextLink") == true &&
-                      ((dataStr = JSON.stringify(data["@odata.nextLink"])),
-                      (data["@odata.nextLink"] = dataStr.split("/v8.2/")[1]));
-                  res.status(200).json(data);
-              })
-              .catch((error) => {
-                  consoleLogger(error);
-                  res.status(400).json(error);
-              })
-        : res.status(400).json();
+          ? axios
+                .get(
+                    WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
+                    azureHeadersPaged(token.access_token)
+                )
+                .then(({ data }) => {
+                    var dataStr;
+                    _.has(data, "@odata.nextLink") == true &&
+                        ((dataStr = JSON.stringify(data["@odata.nextLink"])),
+                        (data["@odata.nextLink"] = dataStr.split("/v8.2/")[1]));
+                    res.status(200).json(data);
+                })
+                .catch((error) => {
+                    consoleLogger(error);
+                    res.status(400).json(error);
+                })
+          : res.status(400).json();
 
     return apiResponse;
 }
diff --git a/pages/api/endpoint/getbasicpartsaveddetails_api.js b/pages/api/endpoint/getbasicpartsaveddetails_api.js
index ad2bf99e..537a76d9 100644
--- a/pages/api/endpoint/getbasicpartsaveddetails_api.js
+++ b/pages/api/endpoint/getbasicpartsaveddetails_api.js
@@ -2,22 +2,12 @@ import axios from "axios";
 import CryptoJS from "crypto-js";
 import { azureHeadersNoOdata } from "../../../actions/core/headers";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var appealTypeName = req.query.appealTypeName;
     var primaryIdAttribute = req.query.primaryIdAttribute;
diff --git a/pages/api/endpoint/getbasicsearch_api.js b/pages/api/endpoint/getbasicsearch_api.js
index 9a0d788a..d0b2cb73 100644
--- a/pages/api/endpoint/getbasicsearch_api.js
+++ b/pages/api/endpoint/getbasicsearch_api.js
@@ -21,25 +21,12 @@ import _ from "lodash";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var searchString = req.query.searchString;
     var token = await getToken();
@@ -71,23 +58,23 @@ export default async function ApiProxy(req, res) {
     var apiResponse = _.isEmpty(req.query)
         ? res.status(400).json()
         : searchString.length > 0
-        ? axios
-              .get(
-                  WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-                  azureHeadersPaged(token.access_token)
-              )
-              .then(({ data }) => {
-                  var dataStr;
-                  _.has(data, "@odata.nextLink") == true &&
-                      ((dataStr = JSON.stringify(data["@odata.nextLink"])),
-                      (data["@odata.nextLink"] = dataStr.split("/v8.2/")[1]));
-                  res.status(200).json(data);
-              })
-              .catch((error) => {
-                  consoleLogger(error);
-                  res.status(400).json(error);
-              })
-        : res.status(400).json();
+          ? axios
+                .get(
+                    WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
+                    azureHeadersPaged(token.access_token)
+                )
+                .then(({ data }) => {
+                    var dataStr;
+                    _.has(data, "@odata.nextLink") == true &&
+                        ((dataStr = JSON.stringify(data["@odata.nextLink"])),
+                        (data["@odata.nextLink"] = dataStr.split("/v8.2/")[1]));
+                    res.status(200).json(data);
+                })
+                .catch((error) => {
+                    consoleLogger(error);
+                    res.status(400).json(error);
+                })
+          : res.status(400).json();
 
     return apiResponse;
 }
diff --git a/pages/api/endpoint/getbasicsearch_by_address_api.js b/pages/api/endpoint/getbasicsearch_by_address_api.js
index 6a77711d..45dacf35 100644
--- a/pages/api/endpoint/getbasicsearch_by_address_api.js
+++ b/pages/api/endpoint/getbasicsearch_by_address_api.js
@@ -21,25 +21,12 @@ import { JSONPath as jsonpath } from "jsonpath-plus";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 const getIncident = async (incidentID) => {
     const queryUrl =
         process.env.API_ROOT +
@@ -48,7 +35,7 @@ const getIncident = async (incidentID) => {
 
     var config = {
         method: "get",
-        url: queryUrl,
+        url: queryUrl
     };
 
     return axios(config)
@@ -84,7 +71,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "0735866b-5482-eb11-aac0-00224800be9c",
             "appealTypeID": "846040018",
             "NavigationProperty": "pinswg_AdvertsIds",
-            "value": "Adverts",
+            "value": "Adverts"
         },
         {
             "LogicalCollectionName": "pinswg_callinss77s",
@@ -94,7 +81,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "dd309e51-4982-eb11-aac0-00224800be9c",
             "appealTypeID": "846040010",
             "NavigationProperty": "pinswg_CallInsS77Ids",
-            "value": "Called In Applications - S77",
+            "value": "Called In Applications - S77"
         },
         {
             "LogicalCollectionName": "pinswg_commonlands",
@@ -104,7 +91,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "4161a618-5082-eb11-aac0-00224800be9c",
             "appealTypeID": "846040016",
             "NavigationProperty": "pinswg_CommonLandIds",
-            "value": "Common Land",
+            "value": "Common Land"
         },
         {
             "LogicalCollectionName":
@@ -115,7 +102,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "0c309f3c-4882-eb11-aac0-00224800be9c",
             "appealTypeID": "846040009",
             "NavigationProperty": "pinswg_CommunityInfrastructureLevyIds",
-            "value": "Community Infrastructure Levy - S117, 118, & 119",
+            "value": "Community Infrastructure Levy - S117, 118, & 119"
         },
         {
             "LogicalCollectionName": "pinswg_compulsorypurchaseorderses",
@@ -125,7 +112,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "054da4c7-5582-eb11-aac0-00224800be9c",
             "appealTypeID": "846040019",
             "NavigationProperty": "pinswg_CompulsoryPurchaseOrdersIds",
-            "value": "Compulsory Purchase Orders",
+            "value": "Compulsory Purchase Orders"
         },
         {
             "LogicalCollectionName": "pinswg_dnses",
@@ -135,7 +122,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "36f07225-4a82-eb11-aac0-00224800be9c",
             "appealTypeID": "846040011",
             "NavigationProperty": "pinswg_DNSIds",
-            "value": "Developments of National Significance",
+            "value": "Developments of National Significance"
         },
         {
             "LogicalCollectionName": "pinswg_electricityacts",
@@ -145,7 +132,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "6aedaab1-4a82-eb11-aac0-00224800be9c",
             "appealTypeID": "846040012",
             "NavigationProperty": "pinswg_ElectricityActIds",
-            "value": "Electricity Act",
+            "value": "Electricity Act"
         },
         {
             "LogicalCollectionName":
@@ -157,8 +144,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "c697be96-9481-eb11-aac0-00224800be9c",
             "appealTypeID": "846040006",
             "NavigationProperty": "pinswg_EnforcementListedBuildingConseIds",
-            "value":
-                "Enforcement Listed Building and Conservation Appeal - S39",
+            "value": "Enforcement Listed Building and Conservation Appeal - S39"
         },
         {
             "LogicalCollectionName": "pinswg_enforcementnoticeappeals174s",
@@ -168,7 +154,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "930a3cc4-9181-eb11-aac0-00224800be9c",
             "appealTypeID": "846040005",
             "NavigationProperty": "pinswg_EnforcementNoticeAppealS174Ids",
-            "value": "Enforcement Notice Appeal - S174",
+            "value": "Enforcement Notice Appeal - S174"
         },
         {
             "LogicalCollectionName": "pinswg_environmentalpermittings",
@@ -178,7 +164,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "62d4aa9a-5682-eb11-aac0-00224800be9c",
             "appealTypeID": "846040020",
             "NavigationProperty": "pinswg_EnforcementPermittingIds",
-            "value": "Environmental Permitting",
+            "value": "Environmental Permitting"
         },
         // {
         //     "LogicalCollectionName": "pinswg_harbourrevisionorders",
@@ -200,7 +186,7 @@ export default async function ApiProxy(req, res) {
             "appealTypeID": "846040017",
             "NavigationProperty": "pinswg_HedgesHedgerowsTreePreservatioIds",
             "value":
-                "High Hedges, Tree Preservation orders, Hedgerows, Tree Replacement Notice.",
+                "High Hedges, Tree Preservation orders, Hedgerows, Tree Replacement Notice."
         },
         {
             "LogicalCollectionName": "pinswg_householderappealhases",
@@ -210,7 +196,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "a6c728b0-9081-eb11-aac0-00224800be9c",
             "appealTypeID": "846040004",
             "NavigationProperty": "pinswg_HouseholderAppealHASIds",
-            "value": "Householder and Minor Commercial Appeals - HAS/CAS",
+            "value": "Householder and Minor Commercial Appeals - HAS/CAS"
         },
         {
             "LogicalCollectionName": "pinswg_lawfuldevelopmentcertificates",
@@ -220,7 +206,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "184e4861-9681-eb11-aac0-00224800be9c",
             "appealTypeID": "846040008",
             "NavigationProperty": "pinswg_LawfulDevelopmentCertificatAppIds",
-            "value": "Lawful Development Certificate Appeal - S194 + 195",
+            "value": "Lawful Development Certificate Appeal - S194 + 195"
         },
         // {
         //     "LogicalCollectionName": "pinswg_ldps",
@@ -249,7 +235,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "bb302784-9581-eb11-aac0-00224800be9c",
             "appealTypeID": "846040007",
             "NavigationProperty": "pinswg_MaintenanceofLandS217Ids",
-            "value": "Maintenance of Land - S217",
+            "value": "Maintenance of Land - S217"
         },
         {
             "LogicalCollectionName": "pinswg_miscellaneouscaseworks",
@@ -258,7 +244,7 @@ export default async function ApiProxy(req, res) {
             "UrlName": "miscellaneouscasework",
             "MetadataId": "f519aa8e-5782-eb11-aac0-00224800be9c",
             "appealTypeID": "846040022",
-            "NavigationProperty": "pinswg_MiscellaneousCasewordIds",
+            "NavigationProperty": "pinswg_MiscellaneousCasewordIds"
         },
         {
             "LogicalCollectionName": "pinswg_nonvalidations",
@@ -268,7 +254,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "37f31a93-5882-eb11-aac0-00224800be9c",
             "appealTypeID": "846040024",
             "NavigationProperty": "pinswg_NonValidationIds",
-            "value": "Non-Validation",
+            "value": "Non-Validation"
         },
         {
             "LogicalCollectionName": "pinswg_planningappeals78s",
@@ -278,7 +264,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "8d7f813a-4183-eb11-aac0-00224800be9c",
             "appealTypeID": "846040000",
             "NavigationProperty": "pinswg_PlanningAppealS78Ids",
-            "value": "Planning Appeal - S78",
+            "value": "Planning Appeal - S78"
         },
         {
             "LogicalCollectionName": "pinswg_planningconditionss73s79s",
@@ -288,7 +274,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "093bf9ff-8d81-eb11-aac0-00224800be9c",
             "appealTypeID": "846040001",
             "NavigationProperty": "pinswg_PlanningConditionsS73S79Ids",
-            "value": "Planning Conditions - S73 + S79",
+            "value": "Planning Conditions - S73 + S79"
         },
         {
             "LogicalCollectionName": "pinswg_planningobligationappeals106s",
@@ -298,7 +284,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "cb8beeae-8f81-eb11-aac0-00224800be9c",
             "appealTypeID": "846040003",
             "NavigationProperty": "pinswg_PlanningObligationAppealS106Ids",
-            "value": "Planning Obligation Appeal - S106",
+            "value": "Planning Obligation Appeal - S106"
         },
         {
             "LogicalCollectionName": "pinswg_sipses",
@@ -309,7 +295,7 @@ export default async function ApiProxy(req, res) {
             "appealTypeID": "846040002",
             "tmpNav": "pinswg_sipsid",
             "NavigationProperty": "pinswg_sipscase",
-            "value": "SIP",
+            "value": "SIP"
         },
 
         {
@@ -320,7 +306,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "4ccc6e93-4f82-eb11-aac0-00224800be9c",
             "appealTypeID": "846040015",
             "NavigationProperty": "pinswg_ROWIds",
-            "value": "Rights of Way",
+            "value": "Rights of Way"
         },
         {
             "LogicalCollectionName": "pinswg_transportandworkacts",
@@ -330,7 +316,7 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "bc3edc4b-7d82-eb11-aac0-00224800be9c",
             "appealTypeID": "846040013",
             "NavigationProperty": "pinswg_TransportandWorkActIds",
-            "value": "Transport and Works Act",
+            "value": "Transport and Works Act"
         },
         {
             "LogicalCollectionName": "pinswg_wayleaves",
@@ -340,8 +326,8 @@ export default async function ApiProxy(req, res) {
             "MetadataId": "a0652117-5782-eb11-aac0-00224800be9c",
             "appealTypeID": "846040021",
             "NavigationProperty": "pinswg_WayleaveIds",
-            "value": "Wayleave",
-        },
+            "value": "Wayleave"
+        }
     ];
 
     const getSearchResultsObj = await Promise.all(
@@ -398,14 +384,15 @@ export default async function ApiProxy(req, res) {
                                 "pinswg_harbourrevisionorders"
                                 ? "pinswg_town"
                                 : item.LogicalCollectionName ==
-                                      "pinswg_transportandworkacts" ||
-                                  item.LogicalCollectionName ==
-                                      "pinswg_electricityacts" ||
-                                  item.LogicalCollectionName ==
-                                      "pinswg_dnses" ||
-                                  item.LogicalCollectionName == "pinswg_sipses"
-                                ? "pinswg_addresstown"
-                                : "pinswg_siteaddresstown") +
+                                        "pinswg_transportandworkacts" ||
+                                    item.LogicalCollectionName ==
+                                        "pinswg_electricityacts" ||
+                                    item.LogicalCollectionName ==
+                                        "pinswg_dnses" ||
+                                    item.LogicalCollectionName ==
+                                        "pinswg_sipses"
+                                  ? "pinswg_addresstown"
+                                  : "pinswg_siteaddresstown") +
                             ", '" +
                             town +
                             "')) "
@@ -420,16 +407,17 @@ export default async function ApiProxy(req, res) {
                                 "pinswg_harbourrevisionorders"
                                 ? "pinswg_county"
                                 : item.LogicalCollectionName ==
-                                      "pinswg_transportandworkacts" ||
-                                  item.LogicalCollectionName ==
-                                      "pinswg_electricityacts" ||
-                                  item.LogicalCollectionName ==
-                                      "pinswg_dnses" ||
-                                  item.LogicalCollectionName == "pinswg_sipses"
-                                ? "pinswg_addresscounty"
-                                : item.LogicalCollectionName == "pinswg_rows"
-                                ? "pinswg_sitecounty"
-                                : "pinswg_siteaddresscounty") +
+                                        "pinswg_transportandworkacts" ||
+                                    item.LogicalCollectionName ==
+                                        "pinswg_electricityacts" ||
+                                    item.LogicalCollectionName ==
+                                        "pinswg_dnses" ||
+                                    item.LogicalCollectionName ==
+                                        "pinswg_sipses"
+                                  ? "pinswg_addresscounty"
+                                  : item.LogicalCollectionName == "pinswg_rows"
+                                    ? "pinswg_sitecounty"
+                                    : "pinswg_siteaddresscounty") +
                             ", '" +
                             county +
                             "')) "
@@ -444,12 +432,12 @@ export default async function ApiProxy(req, res) {
                                 "pinswg_harbourrevisionorders"
                                 ? "pinswg_postcode"
                                 : item.LogicalCollectionName ==
-                                      "pinswg_transportandworkacts" ||
-                                  item.LogicalCollectionName ==
-                                      "pinswg_electricityacts" ||
-                                  item.LogicalCollectionName == "pinswg_dnses"
-                                ? "pinswg_postcode"
-                                : "pinswg_siteaddresspostcode") +
+                                        "pinswg_transportandworkacts" ||
+                                    item.LogicalCollectionName ==
+                                        "pinswg_electricityacts" ||
+                                    item.LogicalCollectionName == "pinswg_dnses"
+                                  ? "pinswg_postcode"
+                                  : "pinswg_siteaddresspostcode") +
                             ", '" +
                             postcode +
                             "')) "
@@ -506,38 +494,38 @@ export default async function ApiProxy(req, res) {
                           "pinswg_harbourrevisionorders"
                           ? "pinswg_addresstown,pinswg_addressline1,pinswg_addresscounty,pinswg_addressline2,pinswg_addresspostcode"
                           : item.LogicalCollectionName ==
-                                "pinswg_electricityacts" ||
-                            item.LogicalCollectionName == "pinswg_dnses" ||
-                            item.LogicalCollectionName == "pinswg_sipses" ||
-                            item.LogicalCollectionName ==
-                                "pinswg_transportandworkacts"
-                          ? "pinswg_addresstown,pinswg_addressline1,pinswg_addresscounty,pinswg_addressline2,pinswg_postcode"
-                          : item.LogicalCollectionName == "pinswg_rows"
-                          ? "pinswg_siteaddresstown,pinswg_siteaddressline1,pinswg_sitecounty,pinswg_siteaddressline2,pinswg_siteaddresspostcode"
-                          : "pinswg_siteaddresstown,pinswg_siteaddressline1,pinswg_siteaddresscounty,pinswg_siteaddressline2,pinswg_siteaddresspostcode") +
+                                  "pinswg_electricityacts" ||
+                              item.LogicalCollectionName == "pinswg_dnses" ||
+                              item.LogicalCollectionName == "pinswg_sipses" ||
+                              item.LogicalCollectionName ==
+                                  "pinswg_transportandworkacts"
+                            ? "pinswg_addresstown,pinswg_addressline1,pinswg_addresscounty,pinswg_addressline2,pinswg_postcode"
+                            : item.LogicalCollectionName == "pinswg_rows"
+                              ? "pinswg_siteaddresstown,pinswg_siteaddressline1,pinswg_sitecounty,pinswg_siteaddressline2,pinswg_siteaddresspostcode"
+                              : "pinswg_siteaddresstown,pinswg_siteaddressline1,pinswg_siteaddresscounty,pinswg_siteaddressline2,pinswg_siteaddresspostcode") +
                       "," +
                       (item.LogicalCollectionName == "pinswg_dnses" ||
                       item.LogicalCollectionName ==
                           "pinswg_transportandworkacts"
                           ? "pinswg_dateofdecision,"
                           : item.LogicalCollectionName ==
-                            "pinswg_nonvalidations"
-                          ? "pinswg_decisionissueddate,"
-                          : item.LogicalCollectionName ==
-                            "pinswg_electricityacts"
-                          ? "pinswg_datedecision,"
-                          : item.LogicalCollectionName == "pinswg_sipses"
-                          ? ""
-                          : "pinswg_casedecisiondate,") +
+                              "pinswg_nonvalidations"
+                            ? "pinswg_decisionissueddate,"
+                            : item.LogicalCollectionName ==
+                                "pinswg_electricityacts"
+                              ? "pinswg_datedecision,"
+                              : item.LogicalCollectionName == "pinswg_sipses"
+                                ? ""
+                                : "pinswg_casedecisiondate,") +
                       (item.LogicalCollectionName == "pinswg_planningappeals78s"
                           ? "pinswg_dicision"
                           : item.LogicalCollectionName ==
-                            "pinswg_transportandworkacts"
-                          ? "pinswg_decsision"
-                          : item.LogicalCollectionName ==
-                            "pinswg_nonvalidations"
-                          ? "pinswg_decisionissued"
-                          : "pinswg_decision") +
+                              "pinswg_transportandworkacts"
+                            ? "pinswg_decsision"
+                            : item.LogicalCollectionName ==
+                                "pinswg_nonvalidations"
+                              ? "pinswg_decisionissued"
+                              : "pinswg_decision") +
                       "," +
                       (item.LogicalCollectionName == "pinswg_nonvalidations" ||
                       item.LogicalCollectionName == "pinswg_sipses"
@@ -615,7 +603,7 @@ export default async function ApiProxy(req, res) {
                                         : "_" +
                                           item.NavigationProperty.toLowerCase() +
                                           "_value"
-                                ],
+                                ]
                         });
                     });
                     return searchResultsObj.push(data);
@@ -632,7 +620,7 @@ export default async function ApiProxy(req, res) {
     searchResultsObj = jsonpath({
         path: "$..[?(@ && @.pinswg_name)]",
         json: searchResultsObj,
-        eval: true,
+        eval: true
     });
 
     searchResultsObj = searchResultsObj.filter((arr) => arr.incidentid != null);
@@ -663,7 +651,7 @@ export default async function ApiProxy(req, res) {
             Object.assign(key, {
                 "pinswg_publishtoweb": incidentObj.pinswg_publishtoweb,
                 "ticketnumber": incidentObj.ticketnumber,
-                "pinswg_lpareference": incidentObj.pinswg_lpareference,
+                "pinswg_lpareference": incidentObj.pinswg_lpareference
             });
 
             return incidentObj;
@@ -695,7 +683,7 @@ export default async function ApiProxy(req, res) {
     let searchResultsOutputObj = {};
     Object.assign(searchResultsOutputObj, {
         "@odata.count": searchResultsObj.length,
-        "value": searchResultsObj,
+        "value": searchResultsObj
     });
 
     return res.status(200).json(searchResultsOutputObj);
diff --git a/pages/api/endpoint/getbasicsearch_by_lparref_api.js b/pages/api/endpoint/getbasicsearch_by_lparref_api.js
index f225562b..f50f2db8 100644
--- a/pages/api/endpoint/getbasicsearch_by_lparref_api.js
+++ b/pages/api/endpoint/getbasicsearch_by_lparref_api.js
@@ -3,22 +3,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    let hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 // ✅ IMPORTANT: Only include the 23 types that actually contain pinswg_lpaapplicationreference
 // You can copy from your existing appealTypeArray but only keep those entities.
 
@@ -31,7 +21,7 @@ var appealTypeArrayWithLpaRef = [
         "MetadataId": "0735866b-5482-eb11-aac0-00224800be9c",
         "appealTypeID": "846040018",
         "NavigationProperty": "pinswg_AdvertsIds",
-        "value": "Adverts",
+        "value": "Adverts"
     },
     {
         "LogicalCollectionName": "pinswg_callinss77s",
@@ -41,7 +31,7 @@ var appealTypeArrayWithLpaRef = [
         "MetadataId": "dd309e51-4982-eb11-aac0-00224800be9c",
         "appealTypeID": "846040010",
         "NavigationProperty": "pinswg_CallInsS77Ids",
-        "value": "Called In Applications - S77",
+        "value": "Called In Applications - S77"
     },
     // {
     //     "LogicalCollectionName": "pinswg_commonlands",
@@ -156,7 +146,7 @@ var appealTypeArrayWithLpaRef = [
         "MetadataId": "a6c728b0-9081-eb11-aac0-00224800be9c",
         "appealTypeID": "846040004",
         "NavigationProperty": "pinswg_HouseholderAppealHASIds",
-        "value": "Householder and Minor Commercial Appeals - HAS/CAS",
+        "value": "Householder and Minor Commercial Appeals - HAS/CAS"
     },
     {
         "LogicalCollectionName": "pinswg_lawfuldevelopmentcertificates",
@@ -166,7 +156,7 @@ var appealTypeArrayWithLpaRef = [
         "MetadataId": "184e4861-9681-eb11-aac0-00224800be9c",
         "appealTypeID": "846040008",
         "NavigationProperty": "pinswg_LawfulDevelopmentCertificatAppIds",
-        "value": "Lawful Development Certificate Appeal - S194 + 195",
+        "value": "Lawful Development Certificate Appeal - S194 + 195"
     },
     // {
     //     "LogicalCollectionName": "pinswg_ldps",
@@ -224,7 +214,7 @@ var appealTypeArrayWithLpaRef = [
         "MetadataId": "8d7f813a-4183-eb11-aac0-00224800be9c",
         "appealTypeID": "846040000",
         "NavigationProperty": "pinswg_PlanningAppealS78Ids",
-        "value": "Planning Appeal - S78",
+        "value": "Planning Appeal - S78"
     },
     {
         "LogicalCollectionName": "pinswg_planningconditionss73s79s",
@@ -234,8 +224,8 @@ var appealTypeArrayWithLpaRef = [
         "MetadataId": "093bf9ff-8d81-eb11-aac0-00224800be9c",
         "appealTypeID": "846040001",
         "NavigationProperty": "pinswg_PlanningConditionsS73S79Ids",
-        "value": "Planning Conditions - S73 + S79",
-    },
+        "value": "Planning Conditions - S73 + S79"
+    }
     // {
     //     "LogicalCollectionName": "pinswg_planningobligationappeals106s",
     //     "LogicalName": "pinswg_planningobligationappeals106",
@@ -321,7 +311,7 @@ export default async function ApiProxy(req, res) {
                     "statuscode",
                     "pinswg_lpaapplicationreference",
                     "pinswg_name",
-                    "_" + item.NavigationProperty.toLowerCase() + "_value", // for incidentid mapping (same pattern you used)
+                    "_" + item.NavigationProperty.toLowerCase() + "_value" // for incidentid mapping (same pattern you used)
                 ].join(",");
 
                 const filter = `contains(pinswg_lpaapplicationreference,'${lowered}')`;
@@ -360,7 +350,7 @@ export default async function ApiProxy(req, res) {
                             "_" +
                                 item.NavigationProperty.toLowerCase() +
                                 "_value"
-                        ] || null,
+                        ] || null
                 }));
 
                 console.log(
@@ -379,7 +369,7 @@ export default async function ApiProxy(req, res) {
 
         const output = {
             "@odata.count": flattened.length,
-            value: flattened,
+            value: flattened
         };
 
         return res.status(200).json(output);
diff --git a/pages/api/endpoint/getbasicsearchdetails_api.js b/pages/api/endpoint/getbasicsearchdetails_api.js
index 2b754be5..7370f714 100644
--- a/pages/api/endpoint/getbasicsearchdetails_api.js
+++ b/pages/api/endpoint/getbasicsearchdetails_api.js
@@ -36,21 +36,12 @@ import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 import { getSelectQuery } from "../../../actions/selectQueryTypes";
 import { getNavigationPropertyByPrimaryAttribute } from "../../../components/utils";
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var appealTypeName = req.query.appealTypeName;
     var primaryIdAttribute = req.query.primaryIdAttribute;
@@ -104,7 +95,7 @@ export default async function ApiProxy(req, res) {
         .then(({ data }) => {
             let flattened = data.value.map((r) => ({
                 ...r,
-                ticketnumber: r[navigationProperty]?.ticketnumber || null,
+                ticketnumber: r[navigationProperty]?.ticketnumber || null
             }));
 
             data.value = flattened;
diff --git a/pages/api/endpoint/getbasicsearchdetailspaged_api.js b/pages/api/endpoint/getbasicsearchdetailspaged_api.js
index 22023e32..e12924db 100644
--- a/pages/api/endpoint/getbasicsearchdetailspaged_api.js
+++ b/pages/api/endpoint/getbasicsearchdetailspaged_api.js
@@ -37,28 +37,28 @@ import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 import { getSelectQuery } from "../../../actions/selectQueryTypes";
 import { getNavigationPropertyByPrimaryAttribute } from "../../../components/utils";
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var appealTypeName = req.query.appealTypeName;
     var primaryIdAttribute = req.query.primaryIdAttribute;
     var incidentID = req.query.incidentID;
+
+    if (
+        !appealTypeName ||
+        !primaryIdAttribute ||
+        !incidentID ||
+        String(appealTypeName).trim().length === 0 ||
+        String(primaryIdAttribute).trim().length === 0 ||
+        String(incidentID).trim().length === 0
+    ) {
+        return res.status(400).json();
+    }
+
     var token = await getToken();
 
     let navigationProperty =
@@ -92,8 +92,6 @@ export default async function ApiProxy(req, res) {
             ? "pinswg_sipscase_value"
             : primaryIdAttribute + "s_value");
 
-    console.log("query: ", queryUrl, "<<<<end query");
-
     return axios
         .get(
             WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
@@ -102,7 +100,7 @@ export default async function ApiProxy(req, res) {
         .then(({ data }) => {
             let flattened = data.value.map((r) => ({
                 ...r,
-                ticketnumber: r[navigationProperty]?.ticketnumber || null,
+                ticketnumber: r[navigationProperty]?.ticketnumber || null
             }));
 
             data.value = flattened;
diff --git a/pages/api/endpoint/getbasicsearchpaged_api.js b/pages/api/endpoint/getbasicsearchpaged_api.js
index 4835d506..547f5846 100644
--- a/pages/api/endpoint/getbasicsearchpaged_api.js
+++ b/pages/api/endpoint/getbasicsearchpaged_api.js
@@ -56,6 +56,11 @@ const WEBAPI_URL =
 export default async function ApiProxy(req, res) {
     var searchString = req.query.searchString;
     var pageNumber = req.query.pageNumber;
+
+    if (typeof searchString === "undefined" || searchString.length === 0) {
+        return res.status(400).json();
+    }
+
     var token = await getToken();
 
     var orderby = req.query.orderby;
@@ -84,8 +89,6 @@ export default async function ApiProxy(req, res) {
             ? "&$skiptoken=" + '<cookie pagenumber="' + pageNumber + '" />'
             : "");
 
-    console.log("basic search paged:", queryUrl);
-
     var apiResponse =
         searchString.length > 0
             ? axios
diff --git a/pages/api/endpoint/getcase_api.js b/pages/api/endpoint/getcase_api.js
index 29b65e44..8a11cd42 100644
--- a/pages/api/endpoint/getcase_api.js
+++ b/pages/api/endpoint/getcase_api.js
@@ -16,25 +16,12 @@ import _ from "lodash";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var incidentID = req.query.incidentID;
     var token = await getToken();
diff --git a/pages/api/endpoint/getcasebyid_api.js b/pages/api/endpoint/getcasebyid_api.js
index 756b5367..7f7f0392 100644
--- a/pages/api/endpoint/getcasebyid_api.js
+++ b/pages/api/endpoint/getcasebyid_api.js
@@ -16,25 +16,12 @@ import _ from "lodash";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var incidentID = req.query.incidentID;
     var token = await getToken();
diff --git a/pages/api/endpoint/getcasemessage_api.js b/pages/api/endpoint/getcasemessage_api.js
index ba78f65a..0bf2f3db 100644
--- a/pages/api/endpoint/getcasemessage_api.js
+++ b/pages/api/endpoint/getcasemessage_api.js
@@ -21,25 +21,12 @@ import _ from "lodash";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var searchString = req.query.id;
     var token = await getToken();
@@ -58,19 +45,19 @@ export default async function ApiProxy(req, res) {
     var apiResponse = _.isEmpty(req.query)
         ? res.status(400).json()
         : searchString.length > 0
-        ? axios
-              .get(
-                  WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-                  azureHeadersPaged(token.access_token)
-              )
-              .then(({ data }) => {
-                  res.status(200).json(data);
-              })
-              .catch((error) => {
-                  consoleLogger(error);
-                  res.status(400).json(error);
-              })
-        : res.status(400).json();
+          ? axios
+                .get(
+                    WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
+                    azureHeadersPaged(token.access_token)
+                )
+                .then(({ data }) => {
+                    res.status(200).json(data);
+                })
+                .catch((error) => {
+                    consoleLogger(error);
+                    res.status(400).json(error);
+                })
+          : res.status(400).json();
 
     return apiResponse;
 }
diff --git a/pages/api/endpoint/getdnscoords_api.js b/pages/api/endpoint/getdnscoords_api.js
index 7c304a39..b63bf64c 100644
--- a/pages/api/endpoint/getdnscoords_api.js
+++ b/pages/api/endpoint/getdnscoords_api.js
@@ -4,25 +4,12 @@ import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 import OSPoint from "ospoint";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 const renameKeys = (obj) => {
     const keyMappings = {
         "pinswg_projectlocation": "location",
@@ -41,7 +28,7 @@ const renameKeys = (obj) => {
             "appellantDisplayName",
         "_pinswg_appellant_value": "appellantId",
         "zoom": "mapZoom",
-        "center": "locationCenter",
+        "center": "locationCenter"
     };
 
     let renamedObj = {};
@@ -63,7 +50,7 @@ const renameKeys = (obj) => {
     if (obj.center) {
         renamedObj.locationCenter = {
             lat: obj.center.lat,
-            lng: obj.center.lng,
+            lng: obj.center.lng
         };
     }
 
@@ -83,7 +70,7 @@ const keysToRemove = [
     "_pinswg_associatedlpa_value@Microsoft.Dynamics.CRM.lookuplogicalname",
     "_pinswg_appellant_value@Microsoft.Dynamics.CRM.lookuplogicalname",
     "pinswg_anticipatedgridrefeasting@OData.Community.Display.V1.FormattedValue",
-    "pinswg_anticipatedgridrefnorthing@OData.Community.Display.V1.FormattedValue",
+    "pinswg_anticipatedgridrefnorthing@OData.Community.Display.V1.FormattedValue"
     // Add any other keys to remove here
 ];
 
@@ -151,7 +138,7 @@ export default async function ApiProxy(req, res) {
                     : parseFloat(siteCoords.latitude),
                 lng: isNaN(parseFloat(siteCoords.longitude))
                     ? -3.437989
-                    : parseFloat(siteCoords.longitude),
+                    : parseFloat(siteCoords.longitude)
             };
         });
 
@@ -159,7 +146,7 @@ export default async function ApiProxy(req, res) {
 
         const updatedData = {
             value: coordsObj.value.map((item) => renameKeys(item)),
-            "@odata.count": coordsObj["@odata.count"],
+            "@odata.count": coordsObj["@odata.count"]
         };
 
         return req.query.hasOwnProperty("fordmw")
diff --git a/pages/api/endpoint/getdnslist_api.js b/pages/api/endpoint/getdnslist_api.js
index b9735928..2b555deb 100644
--- a/pages/api/endpoint/getdnslist_api.js
+++ b/pages/api/endpoint/getdnslist_api.js
@@ -4,33 +4,18 @@ import _ from "lodash";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var token = await getToken();
 
     var queryUrl =
         "incidents?$select=pinswg_environmentalstatementlocation,pinswg_appealcasetype,_customerid_value,_pinswg_associatedlpa_value,_ownerid_value,statuscode,ticketnumber,title &$filter=(pinswg_appealcasetype eq 846040011 or pinswg_appealcasetype eq 846040002) and pinswg_publishtoweb eq true&$orderby=createdon desc&$count=true";
 
-    console.log(queryUrl);
-
     function renameJsonKey(jsonObj, oldKey, newKey) {
         if (jsonObj.hasOwnProperty(oldKey)) {
             jsonObj[newKey] = jsonObj[oldKey]; // Add new key with the same value
diff --git a/pages/api/endpoint/getemailaccountcheck_api.js b/pages/api/endpoint/getemailaccountcheck_api.js
index 70974af4..36111152 100644
--- a/pages/api/endpoint/getemailaccountcheck_api.js
+++ b/pages/api/endpoint/getemailaccountcheck_api.js
@@ -21,22 +21,12 @@ import _ from "lodash";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var emailAddress = req.query.emailAddress;
     var token = await getToken();
@@ -49,19 +39,19 @@ export default async function ApiProxy(req, res) {
     var apiResponse = _.isEmpty(req.query)
         ? res.status(400).json()
         : typeof emailAddress != "undefined" && emailAddress.length > 0
-        ? axios
-              .get(
-                  WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-                  azureHeaders(token.access_token)
-              )
-              .then(({ data }) => {
-                  res.status(200).json(data);
-              })
-              .catch((error) => {
-                  consoleLogger(error);
-                  res.status(400).json(error);
-              })
-        : res.status(400).json();
+          ? axios
+                .get(
+                    WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
+                    azureHeaders(token.access_token)
+                )
+                .then(({ data }) => {
+                    res.status(200).json(data);
+                })
+                .catch((error) => {
+                    consoleLogger(error);
+                    res.status(400).json(error);
+                })
+          : res.status(400).json();
 
     return apiResponse;
 }
diff --git a/pages/api/endpoint/getformdata_api.js b/pages/api/endpoint/getformdata_api.js
index 6a7d5206..acea3b3c 100644
--- a/pages/api/endpoint/getformdata_api.js
+++ b/pages/api/endpoint/getformdata_api.js
@@ -3,25 +3,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var whichForm = req.query.whichForm;
     var token = await getToken();
diff --git a/pages/api/endpoint/getincidentbyid_api.js b/pages/api/endpoint/getincidentbyid_api.js
index 70952d1f..15b135b2 100644
--- a/pages/api/endpoint/getincidentbyid_api.js
+++ b/pages/api/endpoint/getincidentbyid_api.js
@@ -21,25 +21,12 @@ import _ from "lodash";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var searchString = req.query.searchString;
     var token = await getToken();
@@ -54,28 +41,28 @@ export default async function ApiProxy(req, res) {
     var apiResponse = _.isEmpty(req.query)
         ? res.status(400).json()
         : searchString.length > 0
-        ? axios
-              .get(
-                  WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-                  azureHeaders(token.access_token)
-              )
-              .then(({ data }) => {
-                  //console.log(
-                  "\n==========================================\n",
-                      //       "basic search incident: " + queryUrl,
-                      //       "\n\n",
-                      //       "data: " + JSON.stringify(data),
-                      //       "\n\n",
-                      "publihs:" + JSON.stringify(data.value[0]),
-                      "\n==========================================\n";
-                  //);
-                  return res.status(200).json(data);
-              })
-              .catch((error) => {
-                  consoleLogger(error);
-                  res.status(400).json(error);
-              })
-        : res.status(400).json();
+          ? axios
+                .get(
+                    WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
+                    azureHeaders(token.access_token)
+                )
+                .then(({ data }) => {
+                    //console.log(
+                    ("\n==========================================\n",
+                        //       "basic search incident: " + queryUrl,
+                        //       "\n\n",
+                        //       "data: " + JSON.stringify(data),
+                        //       "\n\n",
+                        "publihs:" + JSON.stringify(data.value[0]),
+                        "\n==========================================\n");
+                    //);
+                    return res.status(200).json(data);
+                })
+                .catch((error) => {
+                    consoleLogger(error);
+                    res.status(400).json(error);
+                })
+          : res.status(400).json();
 
     return apiResponse;
 }
diff --git a/pages/api/endpoint/getispublishedbyid_api.js b/pages/api/endpoint/getispublishedbyid_api.js
index 6ac0c646..00318960 100644
--- a/pages/api/endpoint/getispublishedbyid_api.js
+++ b/pages/api/endpoint/getispublishedbyid_api.js
@@ -20,25 +20,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var searchString = req.query.searchString;
     var token = await getToken();
diff --git a/pages/api/endpoint/getlinkedcases_api.js b/pages/api/endpoint/getlinkedcases_api.js
index ebb6e944..b08b0823 100644
--- a/pages/api/endpoint/getlinkedcases_api.js
+++ b/pages/api/endpoint/getlinkedcases_api.js
@@ -21,25 +21,12 @@ import CryptoJS from "crypto-js";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var parentIncidentid = req.query.parentincidentid;
     var token = await getToken();
diff --git a/pages/api/endpoint/getlogin_api.js b/pages/api/endpoint/getlogin_api.js
index 08a738c0..c7185de8 100644
--- a/pages/api/endpoint/getlogin_api.js
+++ b/pages/api/endpoint/getlogin_api.js
@@ -27,22 +27,12 @@ import _ from "lodash";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var emailAddress = req.query.emailAddress;
     var pwd = req.query.pwd;
diff --git a/pages/api/endpoint/getlpa_api.js b/pages/api/endpoint/getlpa_api.js
index 29a2ceef..33cb9409 100644
--- a/pages/api/endpoint/getlpa_api.js
+++ b/pages/api/endpoint/getlpa_api.js
@@ -17,25 +17,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var token = await getToken();
 
diff --git a/pages/api/endpoint/getmycases_api.js b/pages/api/endpoint/getmycases_api.js
index 013c9b74..d510c6f7 100644
--- a/pages/api/endpoint/getmycases_api.js
+++ b/pages/api/endpoint/getmycases_api.js
@@ -22,22 +22,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var loggedInUserId = req.query.loggedInUserId;
     var token = await getToken();
diff --git a/pages/api/endpoint/getmyrepresentations_api.js b/pages/api/endpoint/getmyrepresentations_api.js
index 837b551e..0fc8d7a8 100644
--- a/pages/api/endpoint/getmyrepresentations_api.js
+++ b/pages/api/endpoint/getmyrepresentations_api.js
@@ -22,22 +22,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var loggedInUserId = req.query.loggedInUserId;
     var token = await getToken();
diff --git a/pages/api/endpoint/getmyrepresentationsproxy_api.js b/pages/api/endpoint/getmyrepresentationsproxy_api.js
index d13def37..8fa44901 100644
--- a/pages/api/endpoint/getmyrepresentationsproxy_api.js
+++ b/pages/api/endpoint/getmyrepresentationsproxy_api.js
@@ -22,22 +22,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var loggedInUserId = req.query.loggedInUserId;
     var token = await getToken();
diff --git a/pages/api/endpoint/getpartsavedappeal_api.js b/pages/api/endpoint/getpartsavedappeal_api.js
index afa86f93..1d9bc2de 100644
--- a/pages/api/endpoint/getpartsavedappeal_api.js
+++ b/pages/api/endpoint/getpartsavedappeal_api.js
@@ -4,25 +4,12 @@ import _ from "lodash";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var searchString = req.query.searchString;
     var token = await getToken();
@@ -41,28 +28,28 @@ export default async function ApiProxy(req, res) {
     var apiResponse = _.isEmpty(req.query)
         ? res.status(400).json()
         : searchString.length > 0
-        ? axios
-              .get(
-                  WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-                  azureHeadersPaged(token.access_token)
-              )
-              .then(({ data }) => {
-                  var dataStr;
-                  //   dataStr = dataStr.replace(/: true/gm, `: "Yes"`);
-                  //   dataStr = dataStr.replace(/: false/gm, `: "No"`);
+          ? axios
+                .get(
+                    WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
+                    azureHeadersPaged(token.access_token)
+                )
+                .then(({ data }) => {
+                    var dataStr;
+                    //   dataStr = dataStr.replace(/: true/gm, `: "Yes"`);
+                    //   dataStr = dataStr.replace(/: false/gm, `: "No"`);
 
-                  //   console.log("replaced strinig:", dataStr);
+                    //   console.log("replaced strinig:", dataStr);
 
-                  _.has(data, "@odata.nextLink") == true &&
-                      ((dataStr = JSON.stringify(data["@odata.nextLink"])),
-                      (data["@odata.nextLink"] = dataStr.split("/v8.2/")[1]));
-                  res.status(200).json(data);
-              })
-              .catch((error) => {
-                  consoleLogger(error);
-                  res.status(400).json(error);
-              })
-        : res.status(400).json();
+                    _.has(data, "@odata.nextLink") == true &&
+                        ((dataStr = JSON.stringify(data["@odata.nextLink"])),
+                        (data["@odata.nextLink"] = dataStr.split("/v8.2/")[1]));
+                    res.status(200).json(data);
+                })
+                .catch((error) => {
+                    consoleLogger(error);
+                    res.status(400).json(error);
+                })
+          : res.status(400).json();
 
     return apiResponse;
 }
diff --git a/pages/api/endpoint/getpersonalaccount_api.js b/pages/api/endpoint/getpersonalaccount_api.js
index 9bf7fc5c..5a2f3050 100644
--- a/pages/api/endpoint/getpersonalaccount_api.js
+++ b/pages/api/endpoint/getpersonalaccount_api.js
@@ -22,22 +22,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var contactid = req.query.contactid;
     var token = await getToken();
diff --git a/pages/api/endpoint/getportallogin_api.js b/pages/api/endpoint/getportallogin_api.js
index 00c48ce2..a3f5b7a0 100644
--- a/pages/api/endpoint/getportallogin_api.js
+++ b/pages/api/endpoint/getportallogin_api.js
@@ -21,22 +21,12 @@ import CryptoJS from "crypto-js";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var emailAddress = req.query.emailAddress;
     var checkHash = req.query.hash;
diff --git a/pages/api/endpoint/getportalloginproxy_api.js b/pages/api/endpoint/getportalloginproxy_api.js
index 2ff1643a..d0059910 100644
--- a/pages/api/endpoint/getportalloginproxy_api.js
+++ b/pages/api/endpoint/getportalloginproxy_api.js
@@ -22,22 +22,12 @@ import _ from "lodash";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var emailAddress = req.query.emailAddress;
     var token = await getToken();
@@ -52,20 +42,20 @@ export default async function ApiProxy(req, res) {
     var apiResponse = _.isEmpty(req.query)
         ? res.status(400).json()
         : typeof emailAddress != "undefined" && emailAddress.length > 0
-        ? axios
-              .get(
-                  WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-                  azureHeadersPaged(token.access_token)
-              )
-              .then(({ data }) => {
-                  //console.log(data);
-                  res.status(200).json(data);
-              })
-              .catch((error) => {
-                  consoleLogger(error);
-                  res.status(400).json(error);
-              })
-        : res.status(400).json();
+          ? axios
+                .get(
+                    WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
+                    azureHeadersPaged(token.access_token)
+                )
+                .then(({ data }) => {
+                    //console.log(data);
+                    res.status(200).json(data);
+                })
+                .catch((error) => {
+                    consoleLogger(error);
+                    res.status(400).json(error);
+                })
+          : res.status(400).json();
 
     return apiResponse;
 }
diff --git a/pages/api/endpoint/getportalmoduledetails_api.js b/pages/api/endpoint/getportalmoduledetails_api.js
index df09cecc..4a127a53 100644
--- a/pages/api/endpoint/getportalmoduledetails_api.js
+++ b/pages/api/endpoint/getportalmoduledetails_api.js
@@ -29,22 +29,12 @@ import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 import { getSelectQuery } from "../../../actions/selectQueryTypes";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var appealType = req.query.appealType;
     var caseReference = req.query.caseReference.split("'").join("''");
diff --git a/pages/api/endpoint/getportalmoduledetailsproxy_api.js b/pages/api/endpoint/getportalmoduledetailsproxy_api.js
index 708d10b4..5b833c8c 100644
--- a/pages/api/endpoint/getportalmoduledetailsproxy_api.js
+++ b/pages/api/endpoint/getportalmoduledetailsproxy_api.js
@@ -29,22 +29,12 @@ import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 import { getSelectQuery } from "../../../actions/selectQueryTypes";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var appealType = req.query.appealType;
     var caseReference = req.query.caseReference;
diff --git a/pages/api/endpoint/getpreferredlanguage_api.js b/pages/api/endpoint/getpreferredlanguage_api.js
index 14289afa..57bedf4e 100644
--- a/pages/api/endpoint/getpreferredlanguage_api.js
+++ b/pages/api/endpoint/getpreferredlanguage_api.js
@@ -26,22 +26,12 @@ import {
 } from "../../../actions/core/guards";
 import { consoleLogger, redactSensitive } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var emailAddress = sanitizeString(req.query.emailAddress);
     var token = await getToken();
diff --git a/pages/api/endpoint/getprojecttypes_api.js b/pages/api/endpoint/getprojecttypes_api.js
index cdcee2e4..89c681c9 100644
--- a/pages/api/endpoint/getprojecttypes_api.js
+++ b/pages/api/endpoint/getprojecttypes_api.js
@@ -14,25 +14,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var token = await getToken();
 
diff --git a/pages/api/endpoint/getrepresentations_api.js b/pages/api/endpoint/getrepresentations_api.js
index 1b037140..21422aae 100644
--- a/pages/api/endpoint/getrepresentations_api.js
+++ b/pages/api/endpoint/getrepresentations_api.js
@@ -22,22 +22,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var loggedInUserId = req.query.loggedInUserId;
     var incidentID = req.query.incidentID;
diff --git a/pages/api/endpoint/getrepresentationsproxy_api.js b/pages/api/endpoint/getrepresentationsproxy_api.js
index eec1ab40..6d7169ab 100644
--- a/pages/api/endpoint/getrepresentationsproxy_api.js
+++ b/pages/api/endpoint/getrepresentationsproxy_api.js
@@ -22,22 +22,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var incidentID = req.query.incidentID;
     var token = await getToken();
diff --git a/pages/api/endpoint/getsearchdocumentTypes_api.js b/pages/api/endpoint/getsearchdocumentTypes_api.js
index 5d3efa7d..222f3d06 100644
--- a/pages/api/endpoint/getsearchdocumentTypes_api.js
+++ b/pages/api/endpoint/getsearchdocumentTypes_api.js
@@ -21,25 +21,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 const groupArray = (arr) => {
     const map = new Map();
 
@@ -60,7 +47,7 @@ const groupArray = (arr) => {
                 obj[
                     "pinswg_isharedocumentlocations@OData.Community.Display.V1.FormattedValue"
                 ], // Change 'name' to 'userName'
-            count: count, // Add 'count' as 'occurrences'
+            count: count // Add 'count' as 'occurrences'
         };
 
         result.push(transformedObj);
diff --git a/pages/api/endpoint/getsearchdocumentdetails_api.js b/pages/api/endpoint/getsearchdocumentdetails_api.js
index 10de003d..66a0aa56 100644
--- a/pages/api/endpoint/getsearchdocumentdetails_api.js
+++ b/pages/api/endpoint/getsearchdocumentdetails_api.js
@@ -22,6 +22,7 @@ import _ from "lodash";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WORDKEY = process.env.HASHKEY;
 
@@ -29,18 +30,6 @@ const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 const encryptDocReference = (documentRef) => {
     var hashlink = CryptoJS.HmacSHA256(
         "documents/download/" + documentRef,
@@ -76,7 +65,7 @@ export default async function ApiProxy(req, res) {
                     "pinswg_documentpublisheddate":
                         element.pinswg_documentpublisheddate != null
                             ? element.pinswg_documentpublisheddate
-                            : element.pinswg_latestpublisheddate,
+                            : element.pinswg_latestpublisheddate
                 });
                 element.pinswg_hashlink = encryptDocReference(
                     element.pinswg_isharedocumentreference
diff --git a/pages/api/endpoint/getsearchdocumenthistory_api.js b/pages/api/endpoint/getsearchdocumenthistory_api.js
index a8d63f2b..9c25514d 100644
--- a/pages/api/endpoint/getsearchdocumenthistory_api.js
+++ b/pages/api/endpoint/getsearchdocumenthistory_api.js
@@ -21,25 +21,12 @@ import CryptoJS from "crypto-js";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var documentID = req.query.documentid;
     var token = await getToken();
diff --git a/pages/api/endpoint/getsearchdocumenthistorypaged_api.js b/pages/api/endpoint/getsearchdocumenthistorypaged_api.js
index 49546990..1f164445 100644
--- a/pages/api/endpoint/getsearchdocumenthistorypaged_api.js
+++ b/pages/api/endpoint/getsearchdocumenthistorypaged_api.js
@@ -47,25 +47,12 @@ import CryptoJS from "crypto-js";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var documentID = req.query.documentid;
     var pageNumber = req.query.pageNumber;
diff --git a/pages/api/endpoint/getsipsevents_api.js b/pages/api/endpoint/getsipsevents_api.js
index db483781..42d4eb8f 100644
--- a/pages/api/endpoint/getsipsevents_api.js
+++ b/pages/api/endpoint/getsipsevents_api.js
@@ -3,25 +3,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var caseid = req.query.caseid;
     var token = await getToken();
diff --git a/pages/api/endpoint/getsipsmedia_api.js b/pages/api/endpoint/getsipsmedia_api.js
index b1baa6c6..eb031fd7 100644
--- a/pages/api/endpoint/getsipsmedia_api.js
+++ b/pages/api/endpoint/getsipsmedia_api.js
@@ -3,25 +3,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 // export default async function ApiProxy(req, res) {
 //     var caseid = req.query.caseid;
 //     var token = await getToken();
diff --git a/pages/api/endpoint/getwatchedcases_api.js b/pages/api/endpoint/getwatchedcases_api.js
index 8481af78..84f3f272 100644
--- a/pages/api/endpoint/getwatchedcases_api.js
+++ b/pages/api/endpoint/getwatchedcases_api.js
@@ -22,22 +22,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var loggedInUserId = req.query.loggedInUserId;
     var token = await getToken();
diff --git a/pages/api/endpoint/getwatchedcasesproxy_api.js b/pages/api/endpoint/getwatchedcasesproxy_api.js
index 8f81ef0c..6101b412 100644
--- a/pages/api/endpoint/getwatchedcasesproxy_api.js
+++ b/pages/api/endpoint/getwatchedcasesproxy_api.js
@@ -22,22 +22,12 @@ import CryptoJS from "crypto-js";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
 
 export default async function ApiProxy(req, res) {
diff --git a/pages/api/endpoint/patchcase_api.js b/pages/api/endpoint/patchcase_api.js
index 72be4972..7daa1b1d 100644
--- a/pages/api/endpoint/patchcase_api.js
+++ b/pages/api/endpoint/patchcase_api.js
@@ -15,25 +15,12 @@ import CryptoJS from "crypto-js";
 import _ from "lodash";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var incidentID = req.query.incidentid;
     var queryUrl = "incidents(" + incidentID + ")";
diff --git a/pages/api/endpoint/updateaccount_api.js b/pages/api/endpoint/updateaccount_api.js
index f48cf834..72665641 100644
--- a/pages/api/endpoint/updateaccount_api.js
+++ b/pages/api/endpoint/updateaccount_api.js
@@ -14,25 +14,12 @@ import axios from "axios";
 import CryptoJS from "crypto-js";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var contactId = req.query.contactId;
     var token = await getToken();
diff --git a/pages/api/endpoint/updatecase_api.js b/pages/api/endpoint/updatecase_api.js
index aa2dc39d..87038c5d 100644
--- a/pages/api/endpoint/updatecase_api.js
+++ b/pages/api/endpoint/updatecase_api.js
@@ -13,25 +13,12 @@
 import axios from "axios";
 import CryptoJS from "crypto-js";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var data = JSON.stringify(req.body);
     var appealObj = req.query.appealObj;
diff --git a/pages/api/endpoint/updatepassword_api.js b/pages/api/endpoint/updatepassword_api.js
index e8c66a47..c98e6c34 100644
--- a/pages/api/endpoint/updatepassword_api.js
+++ b/pages/api/endpoint/updatepassword_api.js
@@ -14,25 +14,12 @@ import axios from "axios";
 import CryptoJS from "crypto-js";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var contactId = req.query.contactId;
     var token = await getToken();
diff --git a/pages/api/file/createappealcompletemessageproxy_api.js b/pages/api/file/createappealcompletemessageproxy_api.js
index 81f5bf4b..5ebbdb6c 100644
--- a/pages/api/file/createappealcompletemessageproxy_api.js
+++ b/pages/api/file/createappealcompletemessageproxy_api.js
@@ -2,10 +2,6 @@ import { hashAPIPath } from "../../../actions/core/hash";
 import { getToken } from "../../../actions/core/token";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
-import {
-    getBlobs,
-    createCaseCompleteMessage
-} from "../../../actions/azurestorage";
 import axios from "axios";
 
 import nextConnect from "next-connect";
@@ -14,32 +10,32 @@ import middleware from "../middleware/middleware";
 const ApiProxy = nextConnect();
 ApiProxy.use(middleware);
 
+const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
+
+const hasValue = (value) =>
+    typeof value === "string" && value.trim().length > 0;
+
 ApiProxy.get(async (req, res) => {
     var containerName = req.query.container;
     var tempCaseRef = req.query.tempcaseref;
 
-    console.log("/////Create Case Message:\n", tempCaseRef, "\n//////////////");
-
-    //console.log(hashAPIPath(checkquerypath), checkHash);
-    //console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
+    if (!hasValue(containerName) || !hasValue(tempCaseRef)) {
+        return res.status(400).json();
+    }
 
     var token = await getToken();
 
     var queryUrl =
-        "/api/file/createappealcompletemessageproxy_api?container=" +
-        containerID +
+        "/api/file/createappealcompletemessage_api?container=" +
+        containerName +
         "&tempcaseref=" +
-        caseReference;
+        tempCaseRef;
 
-    var config = {
-        method: "get",
-        url: WEBAPI_URL + queryUrl + hashAPIPath(queryUrl)
-    };
-
-    return axios(config)
-        .then((res) => {
-            return res.data;
-        })
+    return axios
+        .get(
+            BASE_URL + queryUrl + hashAPIPath(queryUrl),
+            azureHeaders(token.access_token)
+        )
         .then(({ data }) => {
             res.status(200).json(data);
         })
diff --git a/pages/api/file/createcase_api.js b/pages/api/file/createcase_api.js
index 7c972240..4a193f2a 100644
--- a/pages/api/file/createcase_api.js
+++ b/pages/api/file/createcase_api.js
@@ -7,25 +7,12 @@ import { getToken } from "../../../actions/core/token";
 import { getCaseBlob, createBlob } from "../../../actions/azurestorage";
 import { getTempCaseRef } from "../../../components/utils";
 import { v4 as uuidv4 } from "uuid";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var createCaseBody = req.body;
     var contactid = req.query.contactid;
@@ -36,6 +23,19 @@ export default async function ApiProxy(req, res) {
     var token = await getToken();
     var tempCaseRef = getTempCaseRef();
 
+    if (
+        typeof contactid === "undefined" ||
+        contactid.length === 0 ||
+        typeof appealTypeId === "undefined" ||
+        appealTypeId.length === 0 ||
+        typeof containerName === "undefined" ||
+        containerName.length === 0 ||
+        typeof lpaID === "undefined" ||
+        lpaID.length === 0
+    ) {
+        return res.status(400).json();
+    }
+
     var data = {
         "title": tempCaseRef,
         "ticketnumber": tempCaseRef,
@@ -53,8 +53,6 @@ export default async function ApiProxy(req, res) {
     delete newData.lpaTypes;
     delete newData.appealTypes;
 
-    console.log("/////Create Case:\n", newData, "\n//////////////");
-
     var newAppealObj = {
         "pinswg_name": tempCaseRef,
         "pinswg_appealcasetype": appealTypeId,
diff --git a/pages/api/file/createrepinvolvement_api.js b/pages/api/file/createrepinvolvement_api.js
index 90732604..24349365 100644
--- a/pages/api/file/createrepinvolvement_api.js
+++ b/pages/api/file/createrepinvolvement_api.js
@@ -14,25 +14,12 @@ import axios from "axios";
 import CryptoJS from "crypto-js";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     if (
         !req.body ||
diff --git a/pages/api/file/deleteawaitingsubmissionfromblob.js b/pages/api/file/deleteawaitingsubmissionfromblob.js
index 33dfe05b..cc99f15e 100644
--- a/pages/api/file/deleteawaitingsubmissionfromblob.js
+++ b/pages/api/file/deleteawaitingsubmissionfromblob.js
@@ -38,14 +38,11 @@ ApiProxy.get(async (req, res) => {
         return res.status(400).json();
     }
 
-    if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
-        await deleteBlob(
-            containerName,
-            casefolderID + "/files/" + blobName
-        ).then((data) => {
+    await deleteBlob(containerName, casefolderID + "/files/" + blobName).then(
+        (data) => {
             return res.status(200).json({ data: data });
-        });
-    }
+        }
+    );
 });
 
 export const config = {
diff --git a/pages/api/file/deleteblob.js b/pages/api/file/deleteblob.js
index 9d99e045..7ff99c4f 100644
--- a/pages/api/file/deleteblob.js
+++ b/pages/api/file/deleteblob.js
@@ -38,14 +38,11 @@ ApiProxy.get(async (req, res) => {
         return res.status(400).json();
     }
 
-    if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
-        await deleteBlob(
-            containerName,
-            casefolderID + "/files/" + blobName
-        ).then((data) => {
+    await deleteBlob(containerName, casefolderID + "/files/" + blobName).then(
+        (data) => {
             return res.status(200).json({ data: data });
-        });
-    }
+        }
+    );
 });
 
 export const config = {
diff --git a/pages/api/file/downloadblob.js b/pages/api/file/downloadblob.js
index 9cbe11f4..eabd0aa8 100644
--- a/pages/api/file/downloadblob.js
+++ b/pages/api/file/downloadblob.js
@@ -4,8 +4,6 @@ import nextConnect from "next-connect";
 import { hashAPIPath } from "../../../actions/core/hash";
 import middleware from "../middleware/middleware";
 
-const WORDKEY = process.env.HASHKEY;
-
 const ApiProxy = nextConnect();
 
 ApiProxy.use(middleware);
diff --git a/pages/api/file/editRepJson.js b/pages/api/file/editRepJson.js
index 65080769..20a19c4f 100644
--- a/pages/api/file/editRepJson.js
+++ b/pages/api/file/editRepJson.js
@@ -42,7 +42,7 @@ export default async function handler(req, res) {
         const tags = {
             containerid: json.containerID,
             caseID: json.ticketnumber,
-            blobType: "Representation",
+            blobType: "Representation"
         };
 
         // Convert back to string
@@ -53,11 +53,10 @@ export default async function handler(req, res) {
             updatedContent,
             Buffer.byteLength(updatedContent),
             {
-                blobHTTPHeaders: { blobContentType: "application/json" },
+                blobHTTPHeaders: { blobContentType: "application/json" }
             }
         );
 
-        console.log("the tags:", tags);
         const withTags = await blockBlobClient.setTags(tags);
         const withMeta = await blockBlobClient.setMetadata(tags);
 
diff --git a/pages/api/file/generateappealpdf.js b/pages/api/file/generateappealpdf.js
index 783c3db4..ae796ee5 100644
--- a/pages/api/file/generateappealpdf.js
+++ b/pages/api/file/generateappealpdf.js
@@ -114,13 +114,32 @@ export default async function handler(req, res) {
     var checkHash = req.query.hash;
     var appealType = req.query.appealType;
 
-    let appealBodyObj = req.body; //JSON.parse(req.body);
+    let appealBodyObj =
+        typeof req.body === "string" ? JSON.parse(req.body) : req.body;
     var containerID = appealBodyObj.containerID;
     var casefolderID = appealBodyObj.casefolderID;
     var caseRef = appealBodyObj.caseRef;
-    var filesList = appealBodyObj.filesList;
     var checkquerypath = "/api/file/generateappealpdf";
 
+    if (
+        typeof checkHash === "undefined" ||
+        checkHash.length === 0 ||
+        typeof appealType === "undefined" ||
+        String(appealType).length === 0 ||
+        typeof containerID === "undefined" ||
+        String(containerID).length === 0 ||
+        typeof casefolderID === "undefined" ||
+        String(casefolderID).length === 0
+    ) {
+        return res.status(400).json();
+    }
+
+    checkquerypath = checkquerypath + "?appealType=" + appealType;
+
+    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+        return res.status(400).json();
+    }
+
     // Create Document Component
     const MyDocument = (values) => {
         switch (values.docProps.pinswg_appealcasetype) {
@@ -200,11 +219,6 @@ export default async function handler(req, res) {
         containerID,
         blobProgress.pinswg_name || blobProgress.caseObj.ticketnumber
     ).then((data) => {
-        console.log(
-            "///////////////////////////////////\nfile created: " +
-                `/files/${pdfFileName}.pdf`,
-            "\n/////////////////////////"
-        );
         return res.status(200).json({
             status: "success",
             data: data,
diff --git a/pages/api/file/generatepdf.js b/pages/api/file/generatepdf.js
index 9962d06b..58624ce7 100644
--- a/pages/api/file/generatepdf.js
+++ b/pages/api/file/generatepdf.js
@@ -178,13 +178,27 @@ export default async function handler(req, res) {
 
     var checkquerypath = "/api/file/generatepdf";
 
+    if (shouldDownload) {
+        checkquerypath += "?download=true";
+    }
+
+    if (typeof checkHash === "undefined" || checkHash.length === 0) {
+        return res.status(400).json();
+    }
+
+    if (
+        hashAPIPath(checkquerypath) !=
+        (checkquerypath.indexOf("?") > -1 ? "&hash=" : "?hash=") + checkHash
+    ) {
+        return res.status(400).json();
+    }
+
     //console.log("-------", checkHash);
     //console.log(hashAPIPath(checkquerypath) == "?hash=" + checkHash);
     //console.log(casefolderID, caseRef);
     // Create Document Component
 
     const MyDocument = (values) => {
-        console.log(values.docProps.locale);
         switch (values.docProps.representationType) {
             case "Questionnaire":
                 switch (values.docProps.appealType) {
@@ -325,11 +339,6 @@ export default async function handler(req, res) {
         reqBodyobj.repfile_name
     )
         .then((data) => {
-            console.log(
-                "///////////////////////////////////\nrep pdf file created: " +
-                    `${caseRef}/files/${reqBodyobj.repfile_name}.pdf`,
-                "\n/////////////////////////"
-            );
             if (shouldDownload) {
                 const filename = `${reqBodyobj.repfile_name || "questionnaire"}.pdf`;
                 res.setHeader("Content-Type", "application/pdf");
diff --git a/pages/api/file/getbloblist.js b/pages/api/file/getbloblist.js
index a36baa52..ff56f48c 100644
--- a/pages/api/file/getbloblist.js
+++ b/pages/api/file/getbloblist.js
@@ -65,19 +65,17 @@ ApiProxy.get(async (req, res) => {
         return res.status(400).json();
     }
 
-    if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
-        casefolderID.split("/").length > 1
-            ? await getRepsFilesBlobs(
-                  containerName,
-                  casefolderID.split("/")[0],
-                  casefolderID.split("/")[1]
-              ).then((data) => {
-                  return res.status(200).json({ "value": [data] });
-              })
-            : await getBlobs(containerName, casefolderID).then((data) => {
-                  return res.status(200).json({ "value": [data] });
-              });
-    }
+    casefolderID.split("/").length > 1
+        ? await getRepsFilesBlobs(
+              containerName,
+              casefolderID.split("/")[0],
+              casefolderID.split("/")[1]
+          ).then((data) => {
+              return res.status(200).json({ "value": [data] });
+          })
+        : await getBlobs(containerName, casefolderID).then((data) => {
+              return res.status(200).json({ "value": [data] });
+          });
 });
 
 export const config = {
diff --git a/pages/api/file/getprogressobjblob.js b/pages/api/file/getprogressobjblob.js
index 8f5ef041..6df0a3ac 100644
--- a/pages/api/file/getprogressobjblob.js
+++ b/pages/api/file/getprogressobjblob.js
@@ -37,19 +37,13 @@ ApiProxy.get(async (req, res) => {
         return res.status(400).json();
     }
 
-    if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
-        const blobObj = await getProgressBlobs(containerName, casefolderID)
-            .then((data) => {
-                return downloadProgressFile(
-                    containerName,
-                    data.path,
-                    casefolderID
-                );
-            })
-            .then((data) => {
-                return res.status(200).json(data);
-            });
-    }
+    await getProgressBlobs(containerName, casefolderID)
+        .then((data) => {
+            return downloadProgressFile(containerName, data.path, casefolderID);
+        })
+        .then((data) => {
+            return res.status(200).json(data);
+        });
 });
 
 export const config = {
diff --git a/pages/api/file/updatecase_api.js b/pages/api/file/updatecase_api.js
index 754dc1d0..37936335 100644
--- a/pages/api/file/updatecase_api.js
+++ b/pages/api/file/updatecase_api.js
@@ -2,25 +2,12 @@ import axios from "axios";
 import CryptoJS from "crypto-js";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
-
-const WORDKEY = process.env.HASHKEY;
+import { hashAPIPath } from "../../../actions/core/hash";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
-const hashAPIPath = (queryPath) => {
-    var hashlink = CryptoJS.HmacSHA256(
-        queryPath,
-        CryptoJS.enc.Hex.parse(WORDKEY)
-    );
-    hashlink = hashlink.toString(CryptoJS.enc.Hex);
-
-    //return "&hash=" + hashlink;
-
-    return (queryPath.indexOf("?") > -1 ? "&hash=" : "?hash=") + hashlink;
-};
-
 export default async function ApiProxy(req, res) {
     var data = JSON.stringify(req.body);
     var appealObj = req.query.appealObj;
@@ -29,6 +16,19 @@ export default async function ApiProxy(req, res) {
     var updateFormCollection = req.query.updateFormCollection;
     var queryUrl = updateFormCollection + "(" + appealObj + ")";
 
+    if (
+        typeof updateFormCollection === "undefined" ||
+        updateFormCollection.length === 0 ||
+        typeof appealObj === "undefined" ||
+        appealObj.length === 0 ||
+        typeof incidentID === "undefined" ||
+        incidentID.length === 0 ||
+        typeof req.body === "undefined" ||
+        req.body === null
+    ) {
+        return res.status(400).json();
+    }
+
     var token = await getToken();
 
     var config = {
diff --git a/tests/phase17/service-behaviour.test.cjs b/tests/phase17/service-behaviour.test.cjs
new file mode 100644
index 00000000..9ad42266
--- /dev/null
+++ b/tests/phase17/service-behaviour.test.cjs
@@ -0,0 +1,261 @@
+const fs = require("fs");
+const path = require("path");
+const vm = require("vm");
+const assert = require("assert");
+
+const rootDir = path.resolve(__dirname, "..", "..");
+
+const loadModule = (relativePath, injected = {}) => {
+    const filePath = path.join(rootDir, relativePath);
+    let source = fs.readFileSync(filePath, "utf8");
+
+    source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
+    source = source.replace(
+        /ReactPDF\.renderToStream\(\s*<MyDocument[\s\S]*?\/>(?:\s*)\)/g,
+        "ReactPDF.renderToStream({})"
+    );
+    source = source.replace(
+        /export default async function\s+(\w+)\s*\(/,
+        "async function $1("
+    );
+    source = source.replace(/export const\s+/g, "const ");
+    source = source.replace(
+        /export default\s+(\w+);/g,
+        "module.exports.default = $1;"
+    );
+
+    source +=
+        '\nif (typeof ApiProxy !== "undefined" && !module.exports.default) module.exports.default = ApiProxy;\n';
+    source +=
+        '\nif (typeof handler !== "undefined" && !module.exports.default) module.exports.default = handler;\n';
+
+    const context = {
+        module: { exports: {} },
+        exports: {},
+        require,
+        process,
+        console: {
+            log: () => {},
+            info: () => {},
+            warn: () => {},
+            error: () => {}
+        },
+        port: 3000,
+        ...injected
+    };
+
+    vm.runInNewContext(source, context, { filename: filePath });
+    return context.module.exports;
+};
+
+const createRes = () => {
+    const state = {
+        statusCode: null,
+        jsonBody: undefined
+    };
+
+    return {
+        state,
+        status(code) {
+            state.statusCode = code;
+            return this;
+        },
+        json(payload) {
+            state.jsonBody = payload;
+            return payload;
+        }
+    };
+};
+
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+const createNextConnectMock = () => {
+    const router = {
+        handler: null,
+        use: () => {},
+        get(fn) {
+            this.handler = fn;
+        },
+        post(fn) {
+            this.handler = fn;
+        }
+    };
+
+    return () => router;
+};
+
+test("generatepdf rejects missing hash with 400", async () => {
+    const createRepPDFBlobCalls = [];
+    const mod = loadModule("pages/api/file/generatepdf.js", {
+        hashAPIPath: () => "?hash=expected",
+        ReactPDF: {
+            renderToStream: async () => ({
+                on: (event, cb) => {
+                    if (event === "data") cb(Buffer.from("pdf"));
+                    if (event === "end") cb();
+                }
+            })
+        },
+        createRepPDFBlob: async (...args) => {
+            createRepPDFBlobCalls.push(args);
+            return { ok: true };
+        },
+        consoleLogger: () => {}
+    });
+
+    const req = { query: {}, body: { caseRef: "c1", repfile_name: "r1" } };
+    const res = createRes();
+
+    await mod.default(req, res);
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(createRepPDFBlobCalls.length, 0);
+});
+
+test("generatepdf rejects invalid hash with 400", async () => {
+    const mod = loadModule("pages/api/file/generatepdf.js", {
+        hashAPIPath: () => "?hash=expected",
+        ReactPDF: {
+            renderToStream: async () => ({
+                on: (event, cb) => {
+                    if (event === "data") cb(Buffer.from("pdf"));
+                    if (event === "end") cb();
+                }
+            })
+        },
+        createRepPDFBlob: async () => ({ ok: true }),
+        consoleLogger: () => {}
+    });
+
+    const req = {
+        query: { hash: "wrong" },
+        body: { caseRef: "c1", repfile_name: "r1" }
+    };
+    const res = createRes();
+
+    await mod.default(req, res);
+    assert.strictEqual(res.state.statusCode, 400);
+});
+
+test("generateappealpdf rejects missing required input with 400", async () => {
+    const calls = [];
+    const mod = loadModule("pages/api/file/generateappealpdf.js", {
+        hashAPIPath: () => "&hash=expected",
+        getTempCaseBlob: async (...args) => {
+            calls.push(args);
+            return {};
+        },
+        getProgressBlobs: async () => ({ path: "p1" }),
+        downloadProgressFile: async () => ({ filesList: [] }),
+        getPickLists: async () => ({}),
+        ReactPDF: {
+            renderToStream: async () => ({
+                on: (event, cb) => {
+                    if (event === "data") cb(Buffer.from("pdf"));
+                    if (event === "end") cb();
+                }
+            })
+        },
+        createAppealPDFBlob: async () => ({ ok: true })
+    });
+
+    const req = { query: { hash: "expected" }, body: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(calls.length, 0);
+});
+
+test("generateappealpdf rejects invalid hash with 400", async () => {
+    const mod = loadModule("pages/api/file/generateappealpdf.js", {
+        hashAPIPath: () => "&hash=expected",
+        getTempCaseBlob: async () => ({}),
+        getProgressBlobs: async () => ({ path: "p1" }),
+        downloadProgressFile: async () => ({ filesList: [] }),
+        getPickLists: async () => ({}),
+        ReactPDF: {
+            renderToStream: async () => ({
+                on: (event, cb) => {
+                    if (event === "data") cb(Buffer.from("pdf"));
+                    if (event === "end") cb();
+                }
+            })
+        },
+        createAppealPDFBlob: async () => ({ ok: true })
+    });
+
+    const req = {
+        query: { hash: "wrong", appealType: "846040000" },
+        body: { containerID: "c1", casefolderID: "case-1", filesList: [] }
+    };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+});
+
+test("createappealcompletemessageproxy_api rejects missing params with 400", async () => {
+    const mod = loadModule(
+        "pages/api/file/createappealcompletemessageproxy_api.js",
+        {
+            getToken: async () => ({ access_token: "t" }),
+            hashAPIPath: () => "&hash=expected",
+            azureHeaders: () => ({}),
+            axios: { get: async () => ({ data: { ok: true } }) },
+            consoleLogger: () => {},
+            nextConnect: createNextConnectMock(),
+            middleware: () => {}
+        }
+    );
+
+    const req = { query: { container: "c1" } };
+    const res = createRes();
+    await mod.default.handler(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+});
+
+test("createappealcompletemessageproxy_api valid input returns 200", async () => {
+    const mod = loadModule(
+        "pages/api/file/createappealcompletemessageproxy_api.js",
+        {
+            getToken: async () => ({ access_token: "t" }),
+            hashAPIPath: () => "&hash=expected",
+            azureHeaders: () => ({}),
+            axios: {
+                get: async () => ({ data: { status: "success" } })
+            },
+            consoleLogger: () => {},
+            nextConnect: createNextConnectMock(),
+            middleware: () => {}
+        }
+    );
+
+    const req = { query: { container: "c1", tempcaseref: "tmp-1" } };
+    const res = createRes();
+    await mod.default.handler(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
+        status: "success"
+    });
+});
+
+const run = async () => {
+    let passed = 0;
+
+    for (const currentTest of tests) {
+        await currentTest.fn();
+        passed += 1;
+    }
+
+    console.log(
+        `Phase 17 behavioural tests passed (${passed}/${tests.length}).`
+    );
+};
+
+run().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});
diff --git a/tests/phase18/service-behaviour.test.cjs b/tests/phase18/service-behaviour.test.cjs
new file mode 100644
index 00000000..3f1480da
--- /dev/null
+++ b/tests/phase18/service-behaviour.test.cjs
@@ -0,0 +1,243 @@
+const fs = require("fs");
+const path = require("path");
+const vm = require("vm");
+const assert = require("assert");
+
+const rootDir = path.resolve(__dirname, "..", "..");
+
+const loadModule = (relativePath, injected = {}) => {
+    const filePath = path.join(rootDir, relativePath);
+    let source = fs.readFileSync(filePath, "utf8");
+
+    source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
+    source = source.replace(
+        /export default async function\s+(\w+)\s*\(/,
+        "async function $1("
+    );
+    source = source.replace(/export const\s+/g, "const ");
+    source = source.replace(
+        /export default\s+(\w+);/g,
+        "module.exports.default = $1;"
+    );
+
+    source +=
+        '\nif (typeof ApiProxy !== "undefined" && !module.exports.default) module.exports.default = ApiProxy;\n';
+
+    const context = {
+        module: { exports: {} },
+        exports: {},
+        require,
+        process,
+        console: {
+            log: () => {},
+            info: () => {},
+            warn: () => {},
+            error: () => {}
+        },
+        ...injected
+    };
+
+    vm.runInNewContext(source, context, { filename: filePath });
+    return context.module.exports;
+};
+
+const createNextConnectMock = () => {
+    const router = {
+        handler: null,
+        use: () => {},
+        get(fn) {
+            this.handler = fn;
+        },
+        post(fn) {
+            this.handler = fn;
+        }
+    };
+
+    return () => router;
+};
+
+const createRes = () => {
+    const state = {
+        statusCode: null,
+        jsonBody: undefined
+    };
+
+    return {
+        state,
+        status(code) {
+            state.statusCode = code;
+            return this;
+        },
+        json(payload) {
+            state.jsonBody = payload;
+            return payload;
+        }
+    };
+};
+
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+test("deletewatchedcases_api rejects missing watchedCaseID with 400", async () => {
+    let axiosCalls = 0;
+    const mod = loadModule("pages/api/endpoint/deletewatchedcases_api.js", {
+        axios: async () => {
+            axiosCalls += 1;
+            return { data: {} };
+        },
+        getToken: async () => ({ access_token: "token" })
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(axiosCalls, 0);
+});
+
+test("getaccounts_api rejects missing emailAddress with 400", async () => {
+    const mod = loadModule("pages/api/endpoint/getaccounts_api.js", {
+        _: { isEmpty: () => true },
+        axios: { get: async () => ({ data: { value: [] } }) },
+        getToken: async () => ({ access_token: "token" }),
+        hashAPIPath: () => "&hash=expected",
+        azureHeaders: () => ({})
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+});
+
+test("getbasicsearchpaged_api rejects missing searchString with 400", async () => {
+    const mod = loadModule("pages/api/endpoint/getbasicsearchpaged_api.js", {
+        axios: { get: async () => ({ data: { value: [] } }) },
+        getToken: async () => ({ access_token: "token" }),
+        hashAPIPath: () => "&hash=expected",
+        azureHeadersPagedCustom: () => ({})
+    });
+
+    const req = { query: { pageNumber: "1" } };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+});
+
+test("getappealpdfdocuments_api rejects missing incidentid with 400", async () => {
+    const mod = loadModule("pages/api/endpoint/getappealpdfdocuments_api.js", {
+        axios: { get: async () => ({ data: { value: [] } }) },
+        getToken: async () => ({ access_token: "token" }),
+        hashAPIPath: () => "&hash=expected",
+        azureHeaders: () => ({})
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+});
+
+test("createcase_api rejects missing required query params with 400", async () => {
+    const blobCalls = [];
+    const mod = loadModule("pages/api/file/createcase_api.js", {
+        _: { isEmpty: () => true },
+        getToken: async () => ({ access_token: "token" }),
+        getTempCaseRef: () => "TMP-1",
+        uuidv4: () => "uuid-1",
+        getCaseBlob: (...args) => blobCalls.push(args),
+        createBlob: (...args) => blobCalls.push(args)
+    });
+
+    const req = { query: {}, body: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(blobCalls.length, 0);
+});
+
+test("updatecase_api rejects missing required inputs with 400", async () => {
+    const mod = loadModule("pages/api/file/updatecase_api.js", {
+        getToken: async () => ({ access_token: "token" }),
+        axios: async () => ({ data: { ok: true } })
+    });
+
+    const req = {
+        query: { incident: "inc-1", appealObj: "appeal-1" },
+        body: { title: "x" }
+    };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+});
+
+test("deleteblob valid hash still returns 200", async () => {
+    const mod = loadModule("pages/api/file/deleteblob.js", {
+        hashAPIPath: () => "&hash=expected",
+        deleteBlob: async () => true,
+        nextConnect: createNextConnectMock(),
+        middleware: () => {}
+    });
+
+    const req = {
+        query: {
+            container: "c1",
+            casefolderID: "case-1",
+            blobname: "f.pdf",
+            hash: "expected"
+        }
+    };
+    const res = createRes();
+    await mod.default.handler(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+});
+
+test("getprogressobjblob valid hash still returns 200", async () => {
+    const mod = loadModule("pages/api/file/getprogressobjblob.js", {
+        hashAPIPath: () => "&hash=expected",
+        getProgressBlobs: async () => ({ path: "p1" }),
+        downloadProgressFile: async () => ({ filesList: [] }),
+        nextConnect: createNextConnectMock(),
+        middleware: () => {}
+    });
+
+    const req = {
+        query: {
+            container: "c1",
+            casefolderID: "case-1",
+            hash: "expected"
+        }
+    };
+    const res = createRes();
+    await mod.default.handler(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
+        filesList: []
+    });
+});
+
+const run = async () => {
+    let passed = 0;
+
+    for (const currentTest of tests) {
+        await currentTest.fn();
+        passed += 1;
+    }
+
+    console.log(
+        `Phase 18 behavioural tests passed (${passed}/${tests.length}).`
+    );
+};
+
+run().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});
diff --git a/tests/phase19/service-behaviour.test.cjs b/tests/phase19/service-behaviour.test.cjs
new file mode 100644
index 00000000..184a2ca9
--- /dev/null
+++ b/tests/phase19/service-behaviour.test.cjs
@@ -0,0 +1,203 @@
+const fs = require("fs");
+const path = require("path");
+const vm = require("vm");
+const assert = require("assert");
+
+const rootDir = path.resolve(__dirname, "..", "..");
+
+const loadModule = (relativePath, injected = {}) => {
+    const filePath = path.join(rootDir, relativePath);
+    let source = fs.readFileSync(filePath, "utf8");
+
+    source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
+    source = source.replace(
+        /export default async function\s+(\w+)\s*\(/g,
+        "async function $1("
+    );
+    source = source.replace(/export const\s+/g, "const ");
+    source = source.replace(
+        /export default\s+(\w+);/g,
+        "module.exports.default = $1;"
+    );
+
+    source +=
+        '\nif (typeof ApiProxy !== "undefined" && !module.exports.default) module.exports.default = ApiProxy;\n';
+
+    const context = {
+        module: { exports: {} },
+        exports: {},
+        require,
+        process,
+        CryptoJS: {
+            HmacSHA256: () => ({ toString: () => "hashed" }),
+            enc: { Hex: { parse: () => "" } }
+        },
+        console: {
+            log: () => {},
+            info: () => {},
+            warn: () => {},
+            error: () => {}
+        },
+        ...injected
+    };
+
+    vm.runInNewContext(source, context, { filename: filePath });
+    return context.module.exports;
+};
+
+const createRes = () => {
+    const state = {
+        statusCode: null,
+        jsonBody: undefined
+    };
+
+    return {
+        state,
+        status(code) {
+            state.statusCode = code;
+            return this;
+        },
+        json(payload) {
+            state.jsonBody = payload;
+            return payload;
+        }
+    };
+};
+
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+test("createwatchedcases_api rejects missing required @odata binds with 400", async () => {
+    let axiosCalls = 0;
+    const axiosMock = async () => {
+        axiosCalls += 1;
+        return { data: {} };
+    };
+    axiosMock.get = async () => ({ data: { value: [] } });
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        axios: axiosMock,
+        getToken: async () => ({ access_token: "token" })
+    });
+
+    const req = { body: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(axiosCalls, 0);
+});
+
+test("createwatchedcases_api rejects malformed @odata bind values with 400", async () => {
+    let axiosCalls = 0;
+    const axiosMock = async () => {
+        axiosCalls += 1;
+        return { data: {} };
+    };
+    axiosMock.get = async () => ({ data: { value: [] } });
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        axios: axiosMock,
+        getToken: async () => ({ access_token: "token" })
+    });
+
+    const req = {
+        body: {
+            "pinswg_WatchedCase@odata.bind": "/incidents/no-brackets",
+            "pinswg_Contact@odata.bind": "/contacts/no-brackets"
+        }
+    };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(axiosCalls, 0);
+});
+
+test("createwatchedcases_api valid body still returns 200", async () => {
+    const axiosConfigCalls = [];
+    const axiosMock = async (config) => {
+        axiosConfigCalls.push(config);
+        return { data: { ok: true } };
+    };
+    axiosMock.get = async () => ({ data: { value: [] } });
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        axios: axiosMock,
+        getToken: async () => ({ access_token: "token" })
+    });
+
+    const req = {
+        body: {
+            "pinswg_WatchedCase@odata.bind": "/incidents(inc-1)",
+            "pinswg_Contact@odata.bind": "/contacts(con-1)"
+        }
+    };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(axiosConfigCalls.length, 1);
+});
+
+test("getappealtypes_api still returns 200 on successful relay call", async () => {
+    const mod = loadModule("pages/api/endpoint/getappealtypes_api.js", {
+        axios: { get: async () => ({ data: { value: [{ id: 1 }] } }) },
+        getToken: async () => ({ access_token: "token" }),
+        azureHeaders: () => ({})
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
+        value: [{ id: 1 }]
+    });
+});
+
+test("getdnslist_api still returns 200 and preserves nextLink transform", async () => {
+    const mod = loadModule("pages/api/endpoint/getdnslist_api.js", {
+        axios: {
+            get: async () => ({
+                data: {
+                    value: [{ id: 1 }],
+                    "@odata.nextLink":
+                        "https://example.test/v8.2/incidents?$skiptoken=abc"
+                }
+            })
+        },
+        getToken: async () => ({ access_token: "token" }),
+        azureHeaders: () => ({}),
+        _: { has: (obj, key) => Object.prototype.hasOwnProperty.call(obj, key) }
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(
+        res.state.jsonBody["@odata.nextLink"],
+        'incidents?$skiptoken=abc"'
+    );
+});
+
+const run = async () => {
+    let passed = 0;
+
+    for (const currentTest of tests) {
+        await currentTest.fn();
+        passed += 1;
+    }
+
+    console.log(
+        `Phase 19 behavioural tests passed (${passed}/${tests.length}).`
+    );
+};
+
+run().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});
diff --git a/tests/phase20/service-behaviour.test.cjs b/tests/phase20/service-behaviour.test.cjs
new file mode 100644
index 00000000..5352e909
--- /dev/null
+++ b/tests/phase20/service-behaviour.test.cjs
@@ -0,0 +1,219 @@
+const fs = require("fs");
+const path = require("path");
+const vm = require("vm");
+const assert = require("assert");
+
+const rootDir = path.resolve(__dirname, "..", "..");
+
+const loadModule = (relativePath, injected = {}) => {
+    const filePath = path.join(rootDir, relativePath);
+    let source = fs.readFileSync(filePath, "utf8");
+
+    source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
+    source = source.replace(
+        /export default async function\s+(\w+)\s*\(/g,
+        "async function $1("
+    );
+    source = source.replace(/export const\s+/g, "const ");
+    source = source.replace(
+        /export default\s+(\w+);/g,
+        "module.exports.default = $1;"
+    );
+
+    source +=
+        '\nif (typeof ApiProxy !== "undefined" && !module.exports.default) module.exports.default = ApiProxy;\n';
+
+    const context = {
+        module: { exports: {} },
+        exports: {},
+        require,
+        process,
+        CryptoJS: {
+            HmacSHA256: () => ({ toString: () => "hashed" }),
+            enc: { Hex: { parse: () => "" } }
+        },
+        console: {
+            log: () => {},
+            info: () => {},
+            warn: () => {},
+            error: () => {}
+        },
+        ...injected
+    };
+
+    vm.runInNewContext(source, context, { filename: filePath });
+    return context.module.exports;
+};
+
+const createRes = () => {
+    const state = {
+        statusCode: null,
+        jsonBody: undefined
+    };
+
+    return {
+        state,
+        status(code) {
+            state.statusCode = code;
+            return this;
+        },
+        json(payload) {
+            state.jsonBody = payload;
+            return payload;
+        }
+    };
+};
+
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+test("getbasicdnssearch_api still returns 200 and preserves nextLink transform", async () => {
+    const mod = loadModule("pages/api/endpoint/getbasicdnssearch_api.js", {
+        axios: {
+            get: async () => ({
+                data: {
+                    value: [{ id: 1 }],
+                    "@odata.nextLink":
+                        "https://example.test/v8.2/incidents?$skiptoken=dns"
+                }
+            })
+        },
+        getToken: async () => ({ access_token: "token" }),
+        azureHeadersPaged: () => ({}),
+        _: { has: (obj, key) => Object.prototype.hasOwnProperty.call(obj, key) }
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(
+        res.state.jsonBody["@odata.nextLink"],
+        'incidents?$skiptoken=dns"'
+    );
+});
+
+test("getbasicdnsurlsearch_api rejects missing searchString with 400", async () => {
+    const mod = loadModule("pages/api/endpoint/getbasicdnsurlsearch_api.js", {
+        axios: { get: async () => ({ data: { value: [] } }) },
+        getToken: async () => ({ access_token: "token" }),
+        azureHeadersPaged: () => ({}),
+        _: { has: () => false, isEmpty: () => true }
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+});
+
+test("getbasicdnsurlsearch_api valid searchString still returns 200", async () => {
+    const mod = loadModule("pages/api/endpoint/getbasicdnsurlsearch_api.js", {
+        axios: {
+            get: async () => ({
+                data: {
+                    value: [{ id: 1 }],
+                    "@odata.nextLink":
+                        "https://example.test/v8.2/incidents?$skiptoken=url"
+                }
+            })
+        },
+        getToken: async () => ({ access_token: "token" }),
+        azureHeadersPaged: () => ({}),
+        _: {
+            has: (obj, key) => Object.prototype.hasOwnProperty.call(obj, key),
+            isEmpty: () => false
+        }
+    });
+
+    const req = { query: { searchString: "farm" } };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(
+        res.state.jsonBody["@odata.nextLink"],
+        'incidents?$skiptoken=url"'
+    );
+});
+
+test("getbasicsearchdetailspaged_api rejects missing required params with 400", async () => {
+    const mod = loadModule(
+        "pages/api/endpoint/getbasicsearchdetailspaged_api.js",
+        {
+            axios: { get: async () => ({ data: { value: [] } }) },
+            getToken: async () => ({ access_token: "token" }),
+            azureHeadersPaged: () => ({}),
+            getSelectQuery: () => "",
+            getNavigationPropertyByPrimaryAttribute: () => ({
+                NavigationProperty: "incident"
+            }),
+            _: { has: () => false }
+        }
+    );
+
+    const req = {
+        query: {
+            appealTypeName: "",
+            primaryIdAttribute: "pinswg_case",
+            incidentID: ""
+        }
+    };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+});
+
+test("getbasicsearchdetailspaged_api valid params still return 200", async () => {
+    const mod = loadModule(
+        "pages/api/endpoint/getbasicsearchdetailspaged_api.js",
+        {
+            axios: {
+                get: async () => ({
+                    data: { value: [{ incident: { ticketnumber: "CAS-1" } }] }
+                })
+            },
+            getToken: async () => ({ access_token: "token" }),
+            azureHeadersPaged: () => ({}),
+            getSelectQuery: () => "",
+            getNavigationPropertyByPrimaryAttribute: () => ({
+                NavigationProperty: "incident"
+            }),
+            _: { has: () => false }
+        }
+    );
+
+    const req = {
+        query: {
+            appealTypeName: "pinswg_cases",
+            primaryIdAttribute: "pinswg_case",
+            incidentID: "incidentid eq guid'1'"
+        }
+    };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(res.state.jsonBody.value[0].ticketnumber, "CAS-1");
+});
+
+const run = async () => {
+    let passed = 0;
+
+    for (const currentTest of tests) {
+        await currentTest.fn();
+        passed += 1;
+    }
+
+    console.log(
+        `Phase 20 behavioural tests passed (${passed}/${tests.length}).`
+    );
+};
+
+run().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});