Campaign deep links

Record Web exposes /link/v1/{templateId}/{shortId} as the authenticated entry point for approved AppsFlyer OneLinks. Existing campaign URLs and authentication replay remain unchanged.

The server route sends the exact OneLink selector to the Record CMS resolver. The response is accepted only when its schema, revision, status, destination, fallback and external URL hosts pass strict validation. A resolved response uses its destination. unknown and unavailable responses use the independently validated fallback. Resolver timeouts, malformed responses and unsupported destinations route safely to Home.

The resolver download is limited to 32 KiB and four seconds. Campaign parameters are allowlisted, count and length bounded, and cannot override values already present in the resolved destination. User supplied URLs are never fetched or logged by this gateway.

The gateway remains behind the existing authentication middleware. Signed out users return through the normal redirectTo flow after login and profile selection. No separate session, entitlement or playback path is introduced.

The cross platform contract, mapping ownership, rollout procedure, rollback behavior and sequence diagrams are documented in RecordPlus OneLink Deep Linking.