Secure Access to Conversation Attachments Changing

TL;DR

HighLevel is making conversation attachments more secure, requiring authenticated access and new permissions for external applications. Marketplace developers and applications accessing attachments outside HighLevel need to update their systems before November 30, 2026.

Who this affects

This change primarily affects marketplace developers and applications that currently access or display email conversation attachments outside of HighLevel. Agency owners using third-party tools that pull these attachments should verify compatibility with their developers. If you do not use external applications to access conversation attachments, you may safely ignore this update for now.

What changed

HighLevel is introducing a new, more secure access model for conversation attachments. This involves several key changes:

• Conversation attachments will no longer rely on directly accessible links.
• Applications accessing attachments outside of HighLevel will require appropriate permission and authenticated access.
• A new permission-based access model for conversation attachments is being introduced.
• Applications will need an additional file access permission to access conversation attachments.
• Attachment links will move to a new, more secure format.
• Applications accessing or displaying attachments outside of HighLevel will need to verify permission before retrieving files.
• Existing attachment links will work until November 30, 2026.
• The first phase covers email conversation attachments.
• The new access controls will permanently take effect on November 30, 2026.

HighLevel has not confirmed what this change replaces or breaks, nor details on limits, plan gating, or rollout status.

Where to find it

HighLevel has not published the specific location in the product for these changes. Since this update affects how external applications access data, the primary changes will likely be reflected in API documentation and developer settings rather than a user-facing section within the HighLevel platform.

How agencies will use this

Consider an agency using an external CRM or client management system that pulls email conversation history, including attachments, from HighLevel for a complete client record. Previously, these systems might have accessed attachments via direct links. With this change, the external CRM will need to be updated to authenticate with HighLevel and request the specific file access permissions for conversation attachments. When a new email with an attachment arrives in a client's HighLevel conversation, the external CRM's integration will need to first verify it has the necessary permissions, then use the new, secure API endpoint to retrieve the attachment file, rather than attempting to download it directly from a stored link. This ensures client data remains secure even when accessed by authorized third-party applications.

Our take

This is a major security update, though its immediate impact is confined to marketplace developers and agencies leveraging external applications for conversation attachments. For most agencies, this won't require immediate action this week. However, if your agency or clients rely on third-party tools that integrate with HighLevel conversations and pull attachments, you should communicate this change to your developers or the application providers. The November 30, 2026 deadline provides ample time for adjustments, but proactive planning is advisable to avoid disruption.