diff --git a/app/Config/Acl.php b/app/Config/Acl.php
index b59905ff..67edbd35 100644
--- a/app/Config/Acl.php
+++ b/app/Config/Acl.php
@@ -42,6 +42,7 @@ class Acl
         '#^/sales#' => ['roles' => [ADMIN_ROLE_ID, HEAD_ROLE_ID, STAFF_ROLE_ID]],
         '#^/expense#' => ['roles' => [ADMIN_ROLE_ID, HEAD_ROLE_ID, STAFF_ROLE_ID]],
         '#^/sendDataToTPA#' => ['roles' => [ADMIN_ROLE_ID, HEAD_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID, MANAGER_ROLE_ID]],
+        '#^/swagger#' => ['roles' => [ADMIN_ROLE_ID, HEAD_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID, MANAGER_ROLE_ID]],
 
 
 
diff --git a/app/Config/Routes.php b/app/Config/Routes.php
index 0129af3d..081b44cd 100755
--- a/app/Config/Routes.php
+++ b/app/Config/Routes.php
@@ -29,6 +29,8 @@ $routes->get('/chatbottest', 'ChatbotControllerNew::chatbotest');
 $routes->get('/chatbot', 'ChatbotControllerNew::chatbot');
 
 $routes->get('/swagger', 'SwaggerController::index', ['filter' => 'authMVC']);
+$routes->get('/swagger/tpa', 'SwaggerController::tpa', ['filter' => 'authMVC']);
+$routes->get('/swagger/tpa-spec', 'SwaggerController::tpaSpec', ['filter' => 'authMVC']);
 $routes->get('/fedeploy', 'DeployController::fedeploy_view', ['filter' => 'authMVC']);
 $routes->post('/fedeploy', 'DeployController::fedeploy', ['filter' => 'authMVC']);
 $routes->get('/visitOffBoardCheck', 'EmployeeController::visitOffBoardCheck');
diff --git a/app/Controllers/EmployeeMultiEventServiceController.php b/app/Controllers/EmployeeMultiEventServiceController.php
index b554a969..4f51f1ad 100644
--- a/app/Controllers/EmployeeMultiEventServiceController.php
+++ b/app/Controllers/EmployeeMultiEventServiceController.php
@@ -256,7 +256,9 @@ class EmployeeMultiEventServiceController extends BaseController
             'is_mandatory' => ['A', 'DA', 'D'],
             'data_type' => 'str',
             'format' => null,
-            'allowed_values' => null
+            'allowed_values' => null,
+            'custom' => 'check_change_event',
+            'params' => ['row', 'file']
         ],
         'date_of_exit' => [
             'col_idx' => 16,
@@ -2348,6 +2350,7 @@ class EmployeeMultiEventServiceController extends BaseController
                         // echo 'insert emp';
                     } else {
                         $value['emp_status'] = 'active';
+                        $value['change_event'] = normalize_file_action($file['action']);
                         $value['created_by'] = $file['created_by'];
                         $value['client_branch_id'] = $file['client_branch_id'];
                         $value['family_floater_key'] = generate_family_floater_key($value['relationship']);
diff --git a/app/Controllers/EmployeeRestController.php b/app/Controllers/EmployeeRestController.php
index fd4a3419..9518d202 100755
--- a/app/Controllers/EmployeeRestController.php
+++ b/app/Controllers/EmployeeRestController.php
@@ -3785,6 +3785,14 @@ class EmployeeRestController extends AdminController
 
                 $this->handleCliamFiles($file_data, $ticket_id, $ticket_message_id);
 
+                // Merge all uploaded PDFs for this ticket into a single combined PDF
+                try {
+                    helper('merge_pdf');
+                    merge_ticket_pdfs((int) $ticket_id);
+                } catch (\Throwable $e) {
+                    log_message('error', 'EmployeeRestController::initiateClaim | merge_ticket_pdfs failed | ticket_id=' . $ticket_id . ' | ' . $e->getMessage());
+                }
+
                 $mail_sent_status = ($this->ticketController->sendAutoMailTrigger($ticket_id));
                 if (gettype($mail_sent_status) == 'array') {
                     $message = 'Claim Iniated Successfully';
@@ -5444,6 +5452,14 @@ class EmployeeRestController extends AdminController
         $result = $this->handleCliamFiles($file_data, $ticket_id, null, false, true);
 
         if (! empty($result)) {
+            // Merge all uploaded PDFs for this ticket into a single combined PDF
+            try {
+                helper('merge_pdf');
+                merge_ticket_pdfs((int) $ticket_id);
+            } catch (\Throwable $e) {
+                log_message('error', 'EmployeeRestController::uploadIRDocs | merge_ticket_pdfs failed | ticket_id=' . $ticket_id . ' | ' . $e->getMessage());
+            }
+
             // $this->ticketMaster->where('id', $ticket_id)->set(['required_docs', $required_docs])->update();
             db_connect()->query(
                 "UPDATE ticket_master SET required_docs = ? WHERE id = ?",
diff --git a/app/Controllers/EmployeeServiceController.php b/app/Controllers/EmployeeServiceController.php
index af2fdd96..064d1dc5 100755
--- a/app/Controllers/EmployeeServiceController.php
+++ b/app/Controllers/EmployeeServiceController.php
@@ -259,7 +259,10 @@ class EmployeeServiceController extends AdminController
                     'is_mandatory' => ['A', 'DA', 'D'],
                     'data_type' => 'str',
                     'format' => null,
-                    'allowed_values' => null
+                    'allowed_values' => null,
+                    'custom' => 'check_change_event',
+                    'params' => ['row', 'file']
+
                 ],
                 'date_of_exit' => [
                     'col_idx' => 16,
@@ -1957,6 +1960,7 @@ class EmployeeServiceController extends AdminController
                                 else
                                 {   
                                     $value['emp_status'] = 'active';
+                                    $value['change_event'] = normalize_file_action($file['action']);
                                     $value['created_by'] = $file['created_by'];
                                     $value['client_branch_id'] = $file['client_branch_id'];
                                     $value['family_floater_key'] = generate_family_floater_key($value['relationship']);
diff --git a/app/Controllers/FhplApiController.php b/app/Controllers/FhplApiController.php
index 542f461b..dfa7db1b 100644
--- a/app/Controllers/FhplApiController.php
+++ b/app/Controllers/FhplApiController.php
@@ -92,7 +92,7 @@ class FhplApiController extends BaseController
             ->join('employees e', 'e.id = tm.emp_id', 'left')
             ->join('client_policy cp', 'tm.client_policy_id = cp.id', 'left')
             ->join('ticket_notes tn', 'tn.ticket_id = tm.id', 'left')
-            ->join('claim_files cf', "cf.ticket_id = tm.id AND cf.file_type = 2 AND cf.mime_type='application/pdf'", 'left')
+            ->join('claim_files cf', "cf.ticket_id = tm.id AND cf.file_type = 4 AND cf.is_active = 1 AND cf.mime_type = 'application/pdf'", 'left')
             ->where('tm.id', $claimId)
             ->get()
             ->getRowArray();
diff --git a/app/Controllers/HealthIndiaApiController.php b/app/Controllers/HealthIndiaApiController.php
index db356888..46b67043 100644
--- a/app/Controllers/HealthIndiaApiController.php
+++ b/app/Controllers/HealthIndiaApiController.php
@@ -113,7 +113,7 @@ class HealthIndiaApiController extends BaseController
             ->join('employees e', 'e.id = tm.emp_id', 'left')
             ->join('client_policy cp', 'tm.client_policy_id = cp.id', 'left')
             ->join('ticket_notes tn', 'tn.ticket_id = tm.id', 'left')
-            ->join('claim_files cf', "cf.ticket_id = tm.id AND cf.file_type = 2 AND cf.mime_type='application/pdf'", 'left')
+            ->join('claim_files cf', "cf.ticket_id = tm.id AND cf.file_type = 4 AND cf.is_active = 1 AND cf.mime_type = 'application/pdf'", 'left')
             ->where('tm.id', $claimId)
             ->get()
             ->getRowArray();
diff --git a/app/Controllers/MediAssistApiController.php b/app/Controllers/MediAssistApiController.php
index 341e3f9b..cb39d93c 100644
--- a/app/Controllers/MediAssistApiController.php
+++ b/app/Controllers/MediAssistApiController.php
@@ -67,7 +67,7 @@ class MediAssistApiController extends BaseController
                   ->join('employees e', 'e.id = tm.emp_id', 'left')
                   ->join('client_policy cp', 'tm.client_policy_id = cp.id', 'left')
                   ->join('ticket_notes tn', 'tn.ticket_id = tm.id', 'left')
-                  ->join('claim_files cf', "cf.ticket_id = tm.id AND cf.file_type = 2 and cf.mime_type = 'application/pdf'", 'left')
+                  ->join('claim_files cf', "cf.ticket_id = tm.id AND cf.file_type = 4 AND cf.is_active = 1 AND cf.mime_type = 'application/pdf'", 'left')
                   ->where('tm.id', $claimId)
                   ->get()
                   ->getRowArray(); // single record
diff --git a/app/Controllers/SwaggerController.php b/app/Controllers/SwaggerController.php
index 75955f60..c84dcc08 100755
--- a/app/Controllers/SwaggerController.php
+++ b/app/Controllers/SwaggerController.php
@@ -1,10 +1,84 @@
 <?php namespace App\Controllers;
 
 use App\Controllers\BaseController;
+use CodeIgniter\Exceptions\PageNotFoundException;
 
 class SwaggerController extends BaseController
 {
-    public function index(){        
-        return view('swagger/index');
-    }    
+    public function index()
+    {
+        return view('swagger/index', [
+            'specUrl' => base_url('assets/api.yaml'),
+            'pageTitle' => 'Swagger UI',
+            'swaggerPreauthorize' => [],
+        ]);
+    }
+
+    /**
+     * Swagger UI for TPA external integrations OpenAPI spec (openapi/tpa-external-integrations.yaml).
+     * Pre-fills Authorize from the same `.env` keys the API controllers use (`getenv`).
+     */
+    public function tpa()
+    {
+        return view('swagger/index', [
+            'specUrl' => base_url('swagger/tpa-spec'),
+            'pageTitle' => 'TPA external APIs — Swagger UI',
+            'swaggerPreauthorize' => $this->buildTpaSwaggerPreauthorize(),
+        ]);
+    }
+
+    /**
+     * Values for Swagger UI Authorize (apiKey / basic). Uses runtime env — keep `/swagger/tpa` access-controlled.
+     *
+     * @return list<array<string, string>>
+     */
+    protected function buildTpaSwaggerPreauthorize(): array
+    {
+        return [
+            ['kind' => 'apiKey', 'scheme' => 'MediAssistUsername', 'value' => $this->readEnvString('MEDI_ASSIST_API_USERNAME')],
+            ['kind' => 'apiKey', 'scheme' => 'MediAssistPassword', 'value' => $this->readEnvString('MEDI_ASSIST_API_PASSWORD')],
+            ['kind' => 'apiKey', 'scheme' => 'VidalSubscriptionKey', 'value' => $this->readEnvString('VIDAL_API_SUBSCRIPTION_KEY')],
+            ['kind' => 'apiKey', 'scheme' => 'VidalIrSubscriptionKey', 'value' => $this->readEnvString('VIDAL_SUBSCRIPTION_KEY')],
+            ['kind' => 'apiKey', 'scheme' => 'VidalWellnessSubscriptionKey', 'value' => $this->readEnvString('VIDAL_WELLNESS_SUBSCRIPTION_KEY')],
+            [
+                'kind' => 'basic',
+                'scheme' => 'HealthIndiaTokenBasic',
+                'username' => $this->readEnvString('HEALTH_INDIA_USERNAME'),
+                'password' => $this->readEnvString('HEALTH_INDIA_PASSWORD'),
+            ],
+        ];
+    }
+
+    /**
+     * Read `.env` the same way as the rest of CodeIgniter (`env()` then `getenv()`).
+     */
+    protected function readEnvString(string $key): string
+    {
+        if (function_exists('env')) {
+            $v = \env($key);
+            if ($v !== null) {
+                return \is_bool($v) ? '' : (string) $v;
+            }
+        }
+
+        $g = \getenv($key);
+
+        return $g === false ? '' : (string) $g;
+    }
+
+    /**
+     * Serves the OpenAPI YAML from project root /openapi (not under public/).
+     */
+    public function tpaSpec()
+    {
+        $path = ROOTPATH . 'openapi/tpa-external-integrations.yaml';
+        if (! is_readable($path)) {
+            throw PageNotFoundException::forPageNotFound('OpenAPI spec not found.');
+        }
+
+        return $this->response
+            ->setHeader('Content-Type', 'application/yaml; charset=UTF-8')
+            ->setHeader('Cache-Control', 'public, max-age=300')
+            ->setBody(file_get_contents($path));
+    }
 }
\ No newline at end of file
diff --git a/app/Controllers/TicketController.php b/app/Controllers/TicketController.php
index d7f3129a..6f64777c 100644
--- a/app/Controllers/TicketController.php
+++ b/app/Controllers/TicketController.php
@@ -2403,7 +2403,7 @@ class TicketController extends BaseController
         $claimFiles  = new ClaimFilesModel();
         $file_record = $claimFiles->where('id', $claim_file_id)->where('is_active', 1)->first();
 
-        if ($file_record === null || (int) ($file_record['file_type'] ?? 0) !== 2) {
+        if ($file_record === null || ! in_array((int) ($file_record['file_type'] ?? 0), [2, 4], true)) {
             throw PageNotFoundException::forPageNotFound();
         }
 
@@ -3677,6 +3677,13 @@ class TicketController extends BaseController
                 $employeeRest = new EmployeeRestController();
                 $result = $employeeRest->handleCliamFiles($file_data, $ticket_id);
                 if(!empty($result)){
+                    // Merge all uploaded PDFs for this ticket into a single combined PDF
+                    try {
+                        helper('merge_pdf');
+                        merge_ticket_pdfs((int) $ticket_id);
+                    } catch (\Throwable $e) {
+                        log_message('error', 'TicketController::upload_url | merge_ticket_pdfs failed | ticket_id=' . $ticket_id . ' | ' . $e->getMessage());
+                    }
                     return $this->respond(['status' => true, 'message' => 'File uploaded successfully ']);
                 }else{
                     return $this->respond(['status' => false, 'message' => 'Failed to upload file ']);
@@ -3704,7 +3711,7 @@ class TicketController extends BaseController
             ->select("
                 *,
                 CASE 
-                    WHEN file_type = 2 AND url IS NOT NULL AND url != '' 
+                    WHEN file_type IN (2, 4) AND url IS NOT NULL AND url != '' 
                     THEN CONCAT('" . base_url('downloadClaimFile/') . "', id)
                     ELSE url
                 END AS url
@@ -4149,12 +4156,18 @@ class TicketController extends BaseController
 
 
             $status = 'inprogress';
+            $claim_dump_date = null;
+            $claim_dump_date_input = trim((string) ($this->request->getPost('claim_dump_date') ?? ''));
+            if (!empty($claim_dump_date_input)) {
+                $claim_dump_date = change_date_format($claim_dump_date_input, 'd/m/Y', 'Y-m-d');
+            }
             $insert_data = [
                 'file_name' => $filename, 
                 'status' => $status,
                 'client_id' => !empty($this->request->getPost('client_id')) ? $this->request->getPost('client_id') : null,
                 'client_policy_id' => !empty($this->request->getPost('client_policy_id')) ? $this->request->getPost('client_policy_id') : null,
                 'tpa_id' => !empty($this->request->getPost('tpa_id')) ? $this->request->getPost('tpa_id') : null,
+                'claim_dump_date' => $claim_dump_date,
             ];
             
             $file_id = $this->claimDumpFileModel->insert($insert_data); 
diff --git a/app/Controllers/VidalApiController.php b/app/Controllers/VidalApiController.php
index d1fd6b40..889ae745 100644
--- a/app/Controllers/VidalApiController.php
+++ b/app/Controllers/VidalApiController.php
@@ -168,7 +168,7 @@ class VidalApiController extends BaseController
             ->join('policy_type pt', 'pt.id = cp.policy_type_id', 'left')
             ->join('employee_polices ep', 'ep.employee_id = e.id AND ep.client_policy_id = cp.id', 'left')
             ->join('ticket_notes tn', 'tn.ticket_id = tm.id', 'left')
-            ->join('claim_files cf', "cf.ticket_id = tm.id AND cf.file_type = 2 and cf.mime_type = 'application/pdf'", 'left')
+            ->join('claim_files cf', "cf.ticket_id = tm.id AND cf.file_type = 4 AND cf.is_active = 1 AND cf.mime_type = 'application/pdf'", 'left')
             ->where('tm.id', $claimId)
             ->get()
             ->getRowArray(); // single record
diff --git a/app/Controllers/VoloApiController.php b/app/Controllers/VoloApiController.php
index 63e63c6d..b1bc0a4b 100644
--- a/app/Controllers/VoloApiController.php
+++ b/app/Controllers/VoloApiController.php
@@ -696,7 +696,7 @@ class VoloApiController extends BaseController
                 cf.url as filePath
             ')
             ->join('client_policy cp', 'tm.client_policy_id = cp.id', 'left')
-            ->join('claim_files cf', "cf.ticket_id = tm.id AND cf.file_type = 2 AND cf.mime_type = 'application/pdf'", 'left')
+            ->join('claim_files cf', "cf.ticket_id = tm.id AND cf.file_type = 4 AND cf.is_active = 1 AND cf.mime_type = 'application/pdf'", 'left')
             ->where('tm.id', $claimId)
             ->get()
             ->getRowArray();
diff --git a/app/Filters/GlobalPostFileUploadGuard.php b/app/Filters/GlobalPostFileUploadGuard.php
index 5b303056..a3303e2f 100644
--- a/app/Filters/GlobalPostFileUploadGuard.php
+++ b/app/Filters/GlobalPostFileUploadGuard.php
@@ -10,43 +10,62 @@ use finfo;
 
 class GlobalPostFileUploadGuard implements FilterInterface
 {
-    /**
-     * Max file size (in bytes) → 25MB
-     */
     protected int $maxFileSize = 25 * 1024 * 1024;
 
-    /**
-     * Allowed MIME types mapped to extensions
-     */
     protected array $allowedMimeMap = [
         'image/jpeg'      => ['jpg', 'jpeg'],
         'image/png'       => ['png'],
         'image/gif'       => ['gif'],
         'image/webp'      => ['webp'],
-        'image/svg+xml'   => ['svg'],
+        // SVG removed — dangerous without server-side sanitization
         'application/pdf' => ['pdf'],
         'application/msword' => ['doc'],
         'application/vnd.openxmlformats-officedocument.wordprocessingml.document' => ['docx'],
         'application/vnd.oasis.opendocument.text' => ['odt'],
-        'text/rtf' => ['rtf'],
+        'text/rtf'        => ['rtf'],
         'application/rtf' => ['rtf'],
-        'application/vnd.ms-excel' => ['xls', 'xlsx'],
+        'application/vnd.ms-excel' => ['xls'],           // removed xlsx from here — it has its own MIME
         'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' => ['xlsx'],
         'application/vnd.oasis.opendocument.spreadsheet' => ['ods'],
-        'text/csv' => ['csv'],
+        'text/csv'        => ['csv'],
         'application/csv' => ['csv'],
-        'text/plain' => ['txt', 'csv'], 
+        'text/plain'      => ['txt'],                     // separated csv out — txt only
+    ];
+
+    protected array $magicBytes = [
+        'image/jpeg'      => ["\xFF\xD8\xFF"],
+        'image/png'       => ["\x89PNG\r\n\x1a\n"],
+        'image/gif'       => ["GIF87a", "GIF89a"],
+        'image/webp'      => ["RIFF"],
+        'application/pdf' => ["%PDF-"],
+        'application/vnd.openxmlformats-officedocument.wordprocessingml.document' => ["PK\x03\x04"],
+        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'       => ["PK\x03\x04"],
+        'application/vnd.oasis.opendocument.text'        => ["PK\x03\x04"],
+        'application/vnd.oasis.opendocument.spreadsheet' => ["PK\x03\x04"],
+        'application/msword'       => ["\xD0\xCF\x11\xE0"],
+        'application/vnd.ms-excel' => ["\xD0\xCF\x11\xE0"],
     ];
 
     protected array $blockedExtensions = [
-        'php', 'phtml', 'html', 'pht', 'phar', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps',
-        'cgi', 'fcgi', 'pl', 'py', 'rb', 'lua', 'tcl', 'go', 'rs', 'jar', 'class',
-        'exe', 'dll', 'com', 'bat', 'cmd', 'msi', 'vbs', 'ps1', 'scr',
-        'sh', 'bash', 'zsh', 'apk', 'app', 'deb', 'rpm', 'bin', 'run',
-        'js', 'mjs', 'jsp', 'asp', 'aspx', 'cer', 'swf',
-        'env', 'ini', 'user.ini', 'htaccess', 'htpasswd', 'conf', 'config', 'log', 'sql',
-        'zip', 'rar', '7z', 'tar', 'gz', 'bz2', 'xz', 'iso',
-        'lnk', 'url', 'reg', 'sys', 'drv', 'vxd', 'tmp', 'bak', 'old', 'backup', 'key', 'pem'
+        'php', 'phtml', 'html', 'htm', 'pht', 'phar',
+        'php3', 'php4', 'php5', 'php7', 'php8', 'phps',
+        'cgi', 'fcgi', 'pl', 'py', 'rb', 'lua', 'tcl',
+        'go', 'rs', 'jar', 'class',
+        'exe', 'dll', 'com', 'bat', 'cmd', 'msi',
+        'vbs', 'ps1', 'ps2', 'scr', 'hta',
+        'sh', 'bash', 'zsh', 'fish',
+        'apk', 'app', 'deb', 'rpm',
+        'bin', 'run', 'elf',
+        'js', 'mjs', 'ts', 'jsx', 'tsx',
+        'jsp', 'jspx', 'asp', 'aspx', 'ascx', 'ashx', 'axd',
+        'cer', 'swf', 'xhtml',
+        'env', 'ini', 'user.ini', 'htaccess', 'htpasswd',
+        'conf', 'config', 'log', 'sql', 'db', 'sqlite',
+        'zip', 'rar', '7z', 'tar', 'gz', 'bz2', 'xz', 'iso', 'cab',
+        'lnk', 'url', 'reg', 'sys', 'drv', 'vxd',
+        'tmp', 'bak', 'old', 'backup',
+        'key', 'pem', 'p12', 'pfx', 'crt', 'csr',
+        'xml', 'xsl', 'xslt', 'svg',
     ];
 
     public function before(RequestInterface $request, $arguments = null)
@@ -68,8 +87,8 @@ class GlobalPostFileUploadGuard implements FilterInterface
     private function validateFileInput($fileData, string $inputName): void
     {
         if (is_array($fileData)) {
-            foreach ($fileData as $file) {
-                $this->validateSingleFile($file, $inputName);
+            foreach ($fileData as $key => $item) {
+                $this->validateFileInput($item, $inputName . '[' . $key . ']');
             }
         } else {
             $this->validateSingleFile($fileData, $inputName);
@@ -78,7 +97,7 @@ class GlobalPostFileUploadGuard implements FilterInterface
 
     private function validateSingleFile($file, string $inputName): void
     {
-        $request = Services::request();
+        $request  = Services::request();
         $clientIp = $request->getIPAddress();
         $uri      = $request->getUri()->getPath();
 
@@ -86,45 +105,211 @@ class GlobalPostFileUploadGuard implements FilterInterface
             if ($file->getError() === UPLOAD_ERR_INI_SIZE || $file->getError() === UPLOAD_ERR_FORM_SIZE) {
                 $this->block("File exceeds server-side size limit", $clientIp, $uri, $inputName, $file->getClientName(), 'unknown', 'unknown', 0);
             }
-            return; 
+            return;
         }
 
-        $originalName = $file->getClientName();
-        $extension    = strtolower($file->getExtension());
-        $mime         = $file->getMimeType(); 
-        $size         = $file->getSize();
+        $originalName    = $file->getClientName();
+        $clientExtension = strtolower($file->getClientExtension());
+        $tempPath        = $file->getTempName();
+        $size            = $file->getSize();
 
-        // --- 1. Fixed Null Byte & Path Traversal Check ---
-        if (preg_match('/\0|[\/\\\]/', $originalName)) {
-            $this->block("Malicious filename characters", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
+        // echo $file->getExtension();
+        // echo '@@@@@@@@@@@@@@@@@@@@@@@';
+        // echo $file->getMimeType();
+        // --- 1. Null Byte & Path Traversal Check ---
+        if (preg_match('/\0|[\/\\\\]/', $originalName)) {
+            $this->block("Malicious filename characters", $clientIp, $uri, $inputName, $originalName, 'unknown', $clientExtension, $size);
         }
 
-        // --- 2. Double Extension Attack Check ---
-        if (preg_match('/\.(php|html|phtml|phar|exe|sh|bat|cmd|js|jsp|asp|aspx|py|pl)\./i', $originalName)) {
-            $this->block("Double extension attack", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
+        // --- 2. Filename length check ---
+        if (strlen($originalName) > 255) {
+            $this->block("Filename too long", $clientIp, $uri, $inputName, substr($originalName, 0, 100) . '...', 'unknown', $clientExtension, $size);
         }
 
-        // --- 3. Forbidden Extension ---
-        if (in_array($extension, $this->blockedExtensions, true)) {
-            $this->block("Forbidden extension", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
+        // --- 3. Double/Multiple Extension Attack ---
+        $nameParts = explode('.', $originalName);
+        if (count($nameParts) > 2) {
+            $allExtensions = array_slice($nameParts, 1);
+            foreach ($allExtensions as $part) {
+                if (in_array(strtolower($part), $this->blockedExtensions, true)) {
+                    $this->block("Double/multiple extension attack detected", $clientIp, $uri, $inputName, $originalName, 'unknown', $clientExtension, $size);
+                }
+            }
         }
 
-        // --- 4. File Size Limit ---
+        // --- 4. Forbidden Extension ---
+        if (in_array($clientExtension, $this->blockedExtensions, true)) {
+            $this->block("Forbidden extension", $clientIp, $uri, $inputName, $originalName, 'unknown', $clientExtension, $size);
+        }
+
+        // --- 5. File Size Limit ---
         if ($size > $this->maxFileSize) {
-            $this->block("File too large", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
+            $this->block("File too large", $clientIp, $uri, $inputName, $originalName, 'unknown', $clientExtension, $size);
         }
 
-        // --- 5. MIME Allow-list Check ---
-        if (!array_key_exists($mime, $this->allowedMimeMap)) {
-            $this->block("MIME type not allowed ($mime)", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
+       // --- 6. Real MIME Detection via finfo on actual temp file ---
+        $finfo        = new finfo(FILEINFO_MIME_TYPE);
+        $detectedMime = $finfo->file($tempPath);
+        
+        // --- 7. Resolve Expected MIME From Extension ---
+        $expectedMime = null;
+
+        foreach ($this->allowedMimeMap as $mime => $extensions) {
+
+            if (in_array($clientExtension, $extensions, true)) {
+                $expectedMime = $mime;
+                break;
+            }
         }
 
-        // --- 6. MIME-Extension Consistency ---
-        if (!in_array($extension, $this->allowedMimeMap[$mime], true)) {
-            $this->block("MIME-extension mismatch", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
+        if ($expectedMime === null) {
+            $this->block(
+                "Extension not allowed",
+                $clientIp,
+                $uri,
+                $inputName,
+                $originalName,
+                $detectedMime,
+                $clientExtension,
+                $size
+            );
+        }
+
+        // --- 8. Magic Bytes Deep Validation ---
+        // validate using EXPECTED MIME instead of detected MIME
+        $this->validateMagicBytes(
+            $tempPath,
+            $expectedMime,
+            $clientIp,
+            $uri,
+            $inputName,
+            $originalName,
+            $clientExtension,
+            $size
+        );
+
+        // // --- 9. Embedded Code Scan ---
+        // $this->scanForEmbeddedCode(
+        //     $tempPath,
+        //     $expectedMime,
+        //     $clientIp,
+        //     $uri,
+        //     $inputName,
+        //     $originalName,
+        //     $clientExtension,
+        //     $size
+        // );
+
+        // --- 10. Final MIME Validation ---
+        // strict match only: generic octet-stream is not accepted
+        if ($detectedMime !== $expectedMime) {
+            $this->block(
+                "MIME-extension mismatch",
+                $clientIp,
+                $uri,
+                $inputName,
+                $originalName,
+                $detectedMime,
+                $clientExtension,
+                $size
+            );
+        }
+
+        // --- 10. Embedded Code Scan ---
+        // $this->scanForEmbeddedCode($tempPath, $detectedMime, $clientIp, $uri, $inputName, $originalName, $clientExtension, $size);
+    }
+
+    private function validateMagicBytes(
+        string $tempPath,
+        string $mime,
+        string $ip,
+        string $uri,
+        string $field,
+        string $filename,
+        string $ext,
+        int $size
+    ): void {
+        if (!isset($this->magicBytes[$mime])) {
+            return;
+        }
+        // echo $mime;print_r($this->magicBytes[$mime]);
+        $handle = fopen($tempPath, 'rb');
+        if (!$handle) {
+            $this->block("Cannot read uploaded file", $ip, $uri, $field, $filename, $mime, $ext, $size);
+        }
+
+        $header = fread($handle, 12);
+        fclose($handle);
+
+        $matched = false;
+        foreach ($this->magicBytes[$mime] as $signature) {
+            if (str_starts_with($header, $signature)) {
+                $matched = true;
+                break;
+            }
+        }
+        // echo $matched;die;
+        // WebP special case: RIFF....WEBP
+        if ($mime === 'image/webp') {
+            $matched = (substr($header, 0, 4) === 'RIFF' && substr($header, 8, 4) === 'WEBP');
+        }
+
+        if (!$matched) {
+            $this->block("Magic bytes mismatch for MIME: $mime", $ip, $uri, $field, $filename, $mime, $ext, $size);
         }
     }
 
+    private function scanForEmbeddedCode(
+        string $tempPath,
+        string $mime,
+        string $ip,
+        string $uri,
+        string $field,
+        string $filename,
+        string $ext,
+        int $size
+    ): void {
+        $scanLimit = 1024 * 1024;
+
+        $content = '';
+        if ($size <= $scanLimit) {
+            $content = file_get_contents($tempPath);
+        } else {
+            $handle = fopen($tempPath, 'rb');
+            if ($handle) {
+                $content  = fread($handle, 10240);
+                fseek($handle, -10240, SEEK_END);
+                $content .= fread($handle, 10240);
+                fclose($handle);
+            }
+        }
+
+        if (empty($content)) {
+            return;
+        }
+
+        $dangerousPatterns = [
+            '/<\?php/i',
+            '/<\?=/i',
+            '/<\?/i',
+            '/<%/i',
+            '/<script\s+.*?runat\s*=\s*["\']?server/i',
+            '/eval\s*\(/i',
+            '/base64_decode\s*\(/i',
+            '/system\s*\(/i',
+            '/exec\s*\(/i',
+            '/passthru\s*\(/i',
+            '/shell_exec\s*\(/i',
+        ];
+
+        foreach ($dangerousPatterns as $pattern) {
+            if (preg_match($pattern, $content)) {
+                $this->block("Embedded code pattern detected in file", $ip, $uri, $field, $filename, $mime, $ext, $size);
+            }
+        }
+    }
+
+    // block() signature and body kept EXACTLY as original — only $ext source changed upstream
     private function block(string $reason, string $ip, string $uri, string $field, string $filename, string $mime, string $ext, int $size): void
     {
         log_message('critical',
@@ -144,4 +329,4 @@ class GlobalPostFileUploadGuard implements FilterInterface
     }
 
     public function after(RequestInterface $request, ResponseInterface $response, $arguments = null) {}
-}
\ No newline at end of file
+}
diff --git a/app/Filters/GlobalPostFileUploadGuard_OLD.php b/app/Filters/GlobalPostFileUploadGuard_OLD.php
new file mode 100644
index 00000000..75d7588b
--- /dev/null
+++ b/app/Filters/GlobalPostFileUploadGuard_OLD.php
@@ -0,0 +1,150 @@
+<?php
+
+namespace App\Filters;
+
+use CodeIgniter\HTTP\RequestInterface;
+use CodeIgniter\HTTP\ResponseInterface;
+use CodeIgniter\Filters\FilterInterface;
+use Config\Services;
+use finfo;
+
+class GlobalPostFileUploadGuard implements FilterInterface
+{
+    /**
+     * Max file size (in bytes) → 25MB
+     */
+    protected int $maxFileSize = 25 * 1024 * 1024;
+
+    /**
+     * Allowed MIME types mapped to extensions
+     */
+    protected array $allowedMimeMap = [
+        'image/jpeg'      => ['jpg', 'jpeg'],
+        'image/png'       => ['png'],
+        'image/gif'       => ['gif'],
+        'image/webp'      => ['webp'],
+        'image/svg+xml'   => ['svg'],
+        'application/pdf' => ['pdf'],
+        'application/msword' => ['doc'],
+        'application/vnd.openxmlformats-officedocument.wordprocessingml.document' => ['docx'],
+        'application/vnd.oasis.opendocument.text' => ['odt'],
+        'text/rtf' => ['rtf'],
+        'application/rtf' => ['rtf'],
+        'application/vnd.ms-excel' => ['xls', 'xlsx'],
+        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' => ['xlsx'],
+        'application/vnd.oasis.opendocument.spreadsheet' => ['ods'],
+        'text/csv' => ['csv'],
+        'application/csv' => ['csv'],
+        'text/plain' => ['txt', 'csv'], 
+    ];
+
+    protected array $blockedExtensions = [
+        'php', 'phtml', 'html', 'pht', 'phar', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps',
+        'cgi', 'fcgi', 'pl', 'py', 'rb', 'lua', 'tcl', 'go', 'rs', 'jar', 'class',
+        'exe', 'dll', 'com', 'bat', 'cmd', 'msi', 'vbs', 'ps1', 'scr',
+        'sh', 'bash', 'zsh', 'apk', 'app', 'deb', 'rpm', 'bin', 'run',
+        'js', 'mjs', 'jsp', 'asp', 'aspx', 'cer', 'swf',
+        'env', 'ini', 'user.ini', 'htaccess', 'htpasswd', 'conf', 'config', 'log', 'sql',
+        'zip', 'rar', '7z', 'tar', 'gz', 'bz2', 'xz', 'iso',
+        'lnk', 'url', 'reg', 'sys', 'drv', 'vxd', 'tmp', 'bak', 'old', 'backup', 'key', 'pem'
+    ];
+
+    public function before(RequestInterface $request, $arguments = null)
+    {
+        if ($request->getMethod() !== 'post') {
+            return;
+        }
+
+        $files = $request->getFiles();
+        if (empty($files)) {
+            return;
+        }
+
+        foreach ($files as $inputName => $fileData) {
+            $this->validateFileInput($fileData, $inputName);
+        }
+    }
+
+    private function validateFileInput($fileData, string $inputName): void
+    {
+        if (is_array($fileData)) {
+            foreach ($fileData as $file) {
+                $this->validateSingleFile($file, $inputName);
+            }
+        } else {
+            $this->validateSingleFile($fileData, $inputName);
+        }
+    }
+
+    private function validateSingleFile($file, string $inputName): void
+    {
+        $request = Services::request();
+        $clientIp = $request->getIPAddress();
+        $uri      = $request->getUri()->getPath();
+
+        if (!$file->isValid()) {
+            if ($file->getError() === UPLOAD_ERR_INI_SIZE || $file->getError() === UPLOAD_ERR_FORM_SIZE) {
+                $this->block("File exceeds server-side size limit", $clientIp, $uri, $inputName, $file->getClientName(), 'unknown', 'unknown', 0);
+            }
+            return; 
+        }
+
+        $originalName = $file->getClientName();
+        $extension    = strtolower($file->getExtension());
+        $client_extension    = strtolower($file->getClientExtension());
+        $mime         = $file->getMimeType(); 
+        $size         = $file->getSize();
+
+        echo $extension.' - '.$client_extension;die;
+
+        // --- 1. Fixed Null Byte & Path Traversal Check ---
+        if (preg_match('/\0|[\/\\\]/', $originalName)) {
+            $this->block("Malicious filename characters", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
+        }
+
+        // --- 2. Double Extension Attack Check ---
+        if (preg_match('/\.(php|html|phtml|phar|exe|sh|bat|cmd|js|jsp|asp|aspx|py|pl)\./i', $originalName)) {
+            $this->block("Double extension attack", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
+        }
+
+        // --- 3. Forbidden Extension ---
+        if (in_array($extension, $this->blockedExtensions, true)) {
+            $this->block("Forbidden extension", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
+        }
+
+        // --- 4. File Size Limit ---
+        if ($size > $this->maxFileSize) {
+            $this->block("File too large", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
+        }
+
+        // --- 5. MIME Allow-list Check ---
+        if (!array_key_exists($mime, $this->allowedMimeMap)) {
+            $this->block("MIME type not allowed ($mime)", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
+        }
+
+        // --- 6. MIME-Extension Consistency ---
+        if (!in_array($extension, $this->allowedMimeMap[$mime], true)) {
+            $this->block("MIME-extension mismatch", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
+        }
+    }
+
+    private function block(string $reason, string $ip, string $uri, string $field, string $filename, string $mime, string $ext, int $size): void
+    {
+        log_message('critical',
+            '[UPLOAD_BLOCKED] {reason} | IP: {ip} | URI: {uri} | Field: {field} | File: {file} | MIME: {mime} | EXT: {ext} | SIZE: {size}',
+            ['reason'=>$reason, 'ip'=>$ip, 'uri'=>$uri, 'field'=>$field, 'file'=>$filename, 'mime'=>$mime, 'ext'=>$ext, 'size'=>$size]
+        );
+
+        $response = Services::response();
+        $response->setStatusCode(403)
+                 ->setJSON([
+                     'status'  => 'error',
+                     'message' => 'File upload rejected: Security policy violation.' . ($reason ? " Reason: $reason." : ''),
+                     'debug'   => (ENVIRONMENT === 'development') ? $reason : null
+                 ])
+                 ->send();
+        exit;
+    }
+
+    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null) {}
+}
\ No newline at end of file
diff --git a/app/Helpers/excel_util_helper.php b/app/Helpers/excel_util_helper.php
index 0c99c9ef..0b7d0039 100755
--- a/app/Helpers/excel_util_helper.php
+++ b/app/Helpers/excel_util_helper.php
@@ -2582,6 +2582,72 @@ if (!function_exists('normalizeGender')) {
     }
 }
 
+if (!function_exists('check_change_event')) {
+    function check_change_event($row, $file)
+    {
+        $change_event = isset($row[15]) ? $row[15] : '';
+        $action = isset($file['action']) ? $file['action'] : '';
+        $allowed_values = [
+            'inception'          => ['inception'],
+            'addition'           => ['addition'],
+            'dependent_addition' => ['dependent addition', 'd-addition'],
+            'missed_inception'   => ['missed inception'],
+        ];
+
+        $normalize = function ($value) {
+            return strtolower(trim((string) $value)); // ✅ Added `return`
+        };
+
+        $change_event = $normalize($change_event);
+
+        // Allow inception with no change_event
+        if ($action === 'inception' && empty($change_event)) {
+            return ['status' => true];
+        }
+
+        // Validate change_event against allowed values for the given action
+        if (isset($allowed_values[$action]) && in_array($change_event, $allowed_values[$action])) {
+            return ['status' => true];
+        }
+
+        // Build error message
+        $expected_values  = $allowed_values[$action] ?? [];
+        $expected_message = "'" . implode("' or '", array_map('strtoupper', $expected_values)) . "'";
+        if ($action === 'inception') {
+            $expected_message .= " or blank";
+        }
+
+        return [
+            'status' => false,
+            'error' => "Rule Conflict: Invalid Change Event for this action\n\n'{$action}'. Expected {$expected_message}",        ];
+    }
+}
+
+if (!function_exists('normalize_file_action')) {
+    function normalize_file_action($file_action)
+    {
+        if($file_action == 'inception'){
+            return 'Inception';
+        }else if($file_action == 'addition'){
+            return 'Addition';
+        }else if($file_action == 'dependent_addition'){
+            return 'Dependent Addition';
+        }else if($file_action == 'deletion'){
+            return 'Deletion';
+        }else if($file_action == 'correction'){
+            return 'Correction';
+        }else if($file_action == 'si_enhancement'){
+            return 'SI Enhancement';
+        }else if($file_action == 'enrollment'){
+            return 'Enrollment';
+        }else if($file_action == 'missed_inception'){
+            return 'Missed Inception';
+        }
+        return '';
+    }
+}
+
+
 // ------------- FUNCTION FOR LEAD MEMBER DATA LIST VALIDATIONS --------------------------------------
 
 if (!function_exists('check_columns_name_exist')) {
diff --git a/app/Helpers/merge_pdf_helper.php b/app/Helpers/merge_pdf_helper.php
new file mode 100644
index 00000000..9316017f
--- /dev/null
+++ b/app/Helpers/merge_pdf_helper.php
@@ -0,0 +1,194 @@
+<?php
+
+use App\Models\ClaimFilesModel;
+use Mpdf\Mpdf;
+use Mpdf\Output\Destination;
+
+if (! defined('MERGED_CLAIM_FILE_TYPE')) {
+    // claim_files.file_type values currently in use:
+    //   1 = legacy letter, 2 = uploaded claim doc, 3 = approved/settle letter
+    //   4 = merged combined PDF (registered by this helper)
+    define('MERGED_CLAIM_FILE_TYPE', 4);
+}
+
+if (! function_exists('merge_ticket_pdfs')) {
+    /**
+     * Merge all active PDF rows in claim_files for a given ticket_master id
+     * into one combined PDF and register that PDF as a new claim_files row
+     * with file_type = MERGED_CLAIM_FILE_TYPE.
+     *
+     * Source rows are picked from claim_files where:
+     *   - ticket_id          = $ticket_master_id
+     *   - is_active          = 1
+     *   - mime_type          = 'application/pdf'
+     *   - file_type          IN $opts['include_file_types']  (default [2, 3])
+     *
+     * @param int   $ticket_master_id
+     * @param array $opts {
+     *     @var bool   $replace             Default true. Soft-delete previous merged row before re-creating.
+     *     @var int    $created_by          Override created_by user id on the inserted row.
+     *     @var int    $ticket_type         Default 1. Stored on the inserted claim_files row.
+     *     @var array  $include_file_types  Default [2, 3].
+     * }
+     * @return array {status, merged_file_id, file_name, pages, source_count, message}
+     */
+    function merge_ticket_pdfs(int $ticket_master_id, array $opts = []): array
+    {
+        $opts += [
+            'replace'            => true,
+            'created_by'         => null,
+            'ticket_type'        => 1,
+            'include_file_types' => [2, 3],
+        ];
+
+        $result = [
+            'status'         => false,
+            'merged_file_id' => null,
+            'file_name'      => null,
+            'pages'          => 0,
+            'source_count'   => 0,
+            'message'        => '',
+        ];
+
+        if ($ticket_master_id <= 0) {
+            $result['message'] = 'Invalid ticket_master_id';
+            return $result;
+        }
+
+        $claimFiles = new ClaimFilesModel();
+
+        $rows = $claimFiles
+            ->where('ticket_id', $ticket_master_id)
+            ->where('is_active', 1)
+            ->where('mime_type', 'application/pdf')
+            ->whereIn('file_type', $opts['include_file_types'])
+            ->orderBy('id', 'ASC')
+            ->findAll();
+
+        if (empty($rows)) {
+            $result['status']  = true;
+            $result['message'] = 'No PDF files to merge';
+            return $result;
+        }
+
+        $uploadDir = rtrim(WRITEPATH, '/\\') . DIRECTORY_SEPARATOR
+                   . 'uploads' . DIRECTORY_SEPARATOR
+                   . 'claim_files' . DIRECTORY_SEPARATOR;
+
+        $sourcePaths = [];
+        foreach ($rows as $row) {
+            $name = ! empty($row['url']) ? $row['url'] : ($row['file_name'] ?? '');
+            if (empty($name)) {
+                continue;
+            }
+            // url column may sometimes hold a full URL; we only care about the file basename on disk.
+            $full = $uploadDir . basename($name);
+            if (is_file($full) && is_readable($full)) {
+                $sourcePaths[] = $full;
+            } else {
+                log_message('error', "merge_ticket_pdfs | missing PDF on disk | claim_file_id={$row['id']} | path={$full}");
+            }
+        }
+
+        if (empty($sourcePaths)) {
+            $result['message'] = 'No readable PDF files on disk';
+            return $result;
+        }
+
+        $result['source_count'] = count($sourcePaths);
+
+        $tempDir = rtrim(WRITEPATH, '/\\') . DIRECTORY_SEPARATOR . 'cache' . DIRECTORY_SEPARATOR . 'mpdf';
+        if (! is_dir($tempDir)) {
+            @mkdir($tempDir, 0775, true);
+        }
+
+        $mergedName = 'merged_' . $ticket_master_id . '_' . time() . '_' . bin2hex(random_bytes(5)) . '.pdf';
+        $mergedPath = $uploadDir . $mergedName;
+
+        try {
+            $mpdf = new Mpdf([
+                'tempDir' => $tempDir,
+                'mode'    => 'utf-8',
+            ]);
+
+            $totalPages = 0;
+            foreach ($sourcePaths as $src) {
+                try {
+                    $pageCount = $mpdf->setSourceFile($src);
+                    for ($p = 1; $p <= $pageCount; $p++) {
+                        $tplId = $mpdf->importPage($p);
+                        $size  = $mpdf->getTemplateSize($tplId);
+                        $mpdf->AddPageByArray([
+                            'orientation' => ($size['width'] > $size['height']) ? 'L' : 'P',
+                            'sheet-size'  => [$size['width'], $size['height']],
+                        ]);
+                        $mpdf->useTemplate($tplId);
+                        $totalPages++;
+                    }
+                } catch (\Throwable $e) {
+                    log_message('error', "merge_ticket_pdfs | failed to import {$src} | " . $e->getMessage());
+                }
+            }
+
+            if ($totalPages === 0) {
+                $result['message'] = 'All source PDFs failed to import';
+                return $result;
+            }
+
+            $mpdf->Output($mergedPath, Destination::FILE);
+        } catch (\Throwable $e) {
+            log_message('error', 'merge_ticket_pdfs | mpdf failure | ticket_id=' . $ticket_master_id . ' | ' . $e->getMessage());
+            $result['message'] = 'Merge failed: ' . $e->getMessage();
+            return $result;
+        }
+
+        if (! is_file($mergedPath)) {
+            $result['message'] = 'Merged file was not created';
+            return $result;
+        }
+
+        if ($opts['replace']) {
+            $claimFiles
+                ->where('ticket_id', $ticket_master_id)
+                ->where('file_type', MERGED_CLAIM_FILE_TYPE)
+                ->where('is_active', 1)
+                ->set(['is_active' => 0])
+                ->update();
+        }
+
+        $insertData = [
+            'ticket_id'   => $ticket_master_id,
+            'ticket_type' => $opts['ticket_type'],
+            'file_type'   => MERGED_CLAIM_FILE_TYPE,
+            'doc_name'    => 'MERGED_CLAIM_DOCS_PDF',
+            'file_name'   => $mergedName,
+            'url'         => $mergedName,
+            'mime_type'   => 'application/pdf',
+            'is_active'   => 1,
+        ];
+        if (! empty($opts['created_by'])) {
+            $insertData['created_by'] = $opts['created_by'];
+        }
+
+        $insertedId = $claimFiles->insert($insertData);
+
+        if (! $insertedId) {
+            log_message('error', 'merge_ticket_pdfs | DB insert failed for merged file | ticket_id=' . $ticket_master_id);
+            @unlink($mergedPath);
+            $result['message'] = 'Failed to register merged file in claim_files';
+            return $result;
+        }
+
+        log_message(
+            'info',
+            "merge_ticket_pdfs | OK | ticket_id={$ticket_master_id} | sources={$result['source_count']} | pages={$totalPages} | claim_file_id={$insertedId}"
+        );
+
+        $result['status']         = true;
+        $result['merged_file_id'] = (int) $insertedId;
+        $result['file_name']      = $mergedName;
+        $result['pages']          = $totalPages;
+        $result['message']        = 'Merged successfully';
+        return $result;
+    }
+}
diff --git a/app/Helpers/utility_helper.php b/app/Helpers/utility_helper.php
index 9498fb88..a79b8b49 100755
--- a/app/Helpers/utility_helper.php
+++ b/app/Helpers/utility_helper.php
@@ -108,6 +108,8 @@ if (! function_exists('file_Upload_for_lead')) {
             }
             $fileName = sanitize_upload_filename($fileToUpload->getName());
             $fileToUpload->move($filepath, $fileName);
+            $fileName = $fileToUpload->getName();
+
             return $fileName;
         } else {
             return "";
diff --git a/app/Libraries/TPAClaimsImportServices/AbhiClaimImportService.php b/app/Libraries/TPAClaimsImportServices/AbhiClaimImportService.php
index 4f6ff966..81a01aec 100644
--- a/app/Libraries/TPAClaimsImportServices/AbhiClaimImportService.php
+++ b/app/Libraries/TPAClaimsImportServices/AbhiClaimImportService.php
@@ -361,6 +361,7 @@ class AbhiClaimImportService extends BaseTpaClaimImportService
                 $item['claim_status_id'] = $this->checkStatusMapping($this->statusMapping, $row['claim_status']);
                 $item['file_id']    = $file_id;
                 $item['claim_dump_ref_id']    = $row['id'];
+                $item['claim_dump_date'] = $file_data['claim_dump_date'] ?? null;
                 $item['created_by'] = $file_data['created_by'] ?? null;
                 $item['claim_type'] = isset($row['mainclaim_prepost_type']) && !empty($row['mainclaim_prepost_type']) && strtolower($row['mainclaim_prepost_type']) == 'normal' ? 1 : 3;
                 $item['priority']           = 1;
diff --git a/app/Libraries/TPAClaimsImportServices/FhplClaimImportService.php b/app/Libraries/TPAClaimsImportServices/FhplClaimImportService.php
index f2de776f..653043ef 100644
--- a/app/Libraries/TPAClaimsImportServices/FhplClaimImportService.php
+++ b/app/Libraries/TPAClaimsImportServices/FhplClaimImportService.php
@@ -427,6 +427,7 @@ class FhplClaimImportService extends BaseTpaClaimImportService
                 $item['claim_status_id'] = $this->checkStatusMapping($this->statusMapping, $row['current_claim_status']) ?? 61;
                 $item['file_id']    = $file_id;
                 $item['claim_dump_ref_id']    = $row['id'];
+                $item['claim_dump_date'] = $file_data['claim_dump_date'] ?? null;
                 $item['created_by'] = $file_data['created_by'] ?? null;
                 $item['claim_type'] = 1;
                 $item['priority']           = 1;
diff --git a/app/Libraries/TPAClaimsImportServices/IciciClaimImportService.php b/app/Libraries/TPAClaimsImportServices/IciciClaimImportService.php
index 736d9f5a..15da3177 100644
--- a/app/Libraries/TPAClaimsImportServices/IciciClaimImportService.php
+++ b/app/Libraries/TPAClaimsImportServices/IciciClaimImportService.php
@@ -342,6 +342,7 @@ class IciciClaimImportService extends BaseTpaClaimImportService
                 $item['claim_status_id'] = $this->checkStatusMapping($this->statusMapping, $row['updated_status']) ?? 61;
                 $item['claim_dump_ref_id']    = $row['id'];
                 $item['file_id']    = $file_id;
+                $item['claim_dump_date'] = $file_data['claim_dump_date'] ?? null;
                 $item['created_by'] = $file_data['created_by'] ?? null;
                 $item['claim_type'] = 1;
                 $item['priority']           = 1;
diff --git a/app/Libraries/TPAClaimsImportServices/MediAssistClaimImportService.php b/app/Libraries/TPAClaimsImportServices/MediAssistClaimImportService.php
index a853ade6..a6ea7d0c 100644
--- a/app/Libraries/TPAClaimsImportServices/MediAssistClaimImportService.php
+++ b/app/Libraries/TPAClaimsImportServices/MediAssistClaimImportService.php
@@ -375,6 +375,7 @@ class MediAssistClaimImportService extends BaseTpaClaimImportService
                 $item['claim_dump_ref_id']    = $row['id'];
                 $item['file_id']              = $file_id;
                 $item['claim_status_id']      = $this->checkStatusMapping($this->statusMapping, $row['claim_status']) ?? 61;
+                $item['claim_dump_date'] = $file_data['claim_dump_date'] ?? null;
                 $item['created_by'] = $file_data['created_by'] ?? null;
                 $item['claim_type'] = 1;
                 $item['priority']           = 1;
diff --git a/app/Libraries/TPAClaimsImportServices/RcareClaimImportService.php b/app/Libraries/TPAClaimsImportServices/RcareClaimImportService.php
index dc9cf54a..0b93f149 100644
--- a/app/Libraries/TPAClaimsImportServices/RcareClaimImportService.php
+++ b/app/Libraries/TPAClaimsImportServices/RcareClaimImportService.php
@@ -328,6 +328,7 @@ class RcareClaimImportService extends BaseTpaClaimImportService
                 $item['file_id']    = $file_id;
                 $item['created_by'] = $file_data['created_by'] ?? null;
                 $item['claim_dump_ref_id']    = $row['id'];
+                $item['claim_dump_date'] = $file_data['claim_dump_date'] ?? null;
                 $item['claim_type'] = 1;
                 $item['priority']           = 1;
                 $item['mode_of_intimation'] = 5;
diff --git a/app/Libraries/TPAClaimsImportServices/VidalClaimImportService.php b/app/Libraries/TPAClaimsImportServices/VidalClaimImportService.php
index b263109c..a0876b92 100644
--- a/app/Libraries/TPAClaimsImportServices/VidalClaimImportService.php
+++ b/app/Libraries/TPAClaimsImportServices/VidalClaimImportService.php
@@ -568,6 +568,7 @@ class VidalClaimImportService extends BaseTpaClaimImportService
                 $item['claim_status_id'] = $this->checkStatusMapping($this->statusMapping, $row['claim_status']) ?? 61;
                 $item['file_id']    = $file_id;
                 $item['claim_dump_ref_id']    = $row['id'];
+                $item['claim_dump_date'] = $file_data['claim_dump_date'] ?? null;
                 $item['created_by'] = $file_data['created_by'] ?? null;
                 $item['claim_type'] = isset($row['mainclaim_prepost_type']) && !empty($row['mainclaim_prepost_type']) && strtolower($row['mainclaim_prepost_type']) == 'normal' ? 1 : 3;
                 $item['priority']           = 1;
@@ -599,6 +600,8 @@ class VidalClaimImportService extends BaseTpaClaimImportService
 
     public function mapClaimMasterDataOld($file_id): array
     {
+        $claimDumpFileModel = new ClaimDumpFileModel();
+        $file_data = $claimDumpFileModel->where('id', $file_id)->first();
 
         $tpaClaimDumpData = $this->db
             ->table('claims_dump_vidal')
@@ -686,6 +689,7 @@ class VidalClaimImportService extends BaseTpaClaimImportService
 
             // Meta fields
             $item['file_id']    = $file_id;
+            $item['claim_dump_date'] = $file_data['claim_dump_date'] ?? null;
             $item['created_by'] = get_session_userid() ?? null;
             $item['claim_type'] = isset($row['mainclaim_prepost_type']) && !empty($row['mainclaim_prepost_type']) && strtolower($row['mainclaim_prepost_type']) == 'normal' ? 1 : 3;
             $item['claim_created_by'] = 'DUMP_TPA';
diff --git a/app/Models/ClaimDumpFileModel.php b/app/Models/ClaimDumpFileModel.php
index e34d6116..c6466479 100644
--- a/app/Models/ClaimDumpFileModel.php
+++ b/app/Models/ClaimDumpFileModel.php
@@ -13,6 +13,7 @@ class ClaimDumpFileModel extends Model
         "client_id",
         "client_policy_id",
         "tpa_id",
+        "claim_dump_date",
         "file_name",
         "status",
         "reason",
diff --git a/app/Models/TicketMasterModel.php b/app/Models/TicketMasterModel.php
index d6202941..8a6128ca 100644
--- a/app/Models/TicketMasterModel.php
+++ b/app/Models/TicketMasterModel.php
@@ -97,6 +97,8 @@ class TicketMasterModel extends Model
         'last_updated_by',
         'tpa_shortfall_no',
         'claim_created_by',
+        'claim_dump_date'
+
 
     ];
 
diff --git a/app/Views/claim_dump_file_list.php b/app/Views/claim_dump_file_list.php
index ab3ca668..ee00683e 100644
--- a/app/Views/claim_dump_file_list.php
+++ b/app/Views/claim_dump_file_list.php
@@ -267,6 +267,10 @@
                                     <?php } ?>
                                 </select>
                             </div>
+                            <div class="form-group col-md-12">
+                                <label for="claim_dump_date">Claim Dump Date</label>
+                                <input type="text" class="form-control" id="claim_dump_date" name="claim_dump_date" placeholder="Select claim dump date" autocomplete="off">
+                            </div>
                         </div>
                         <div class="form-row" id="file_upload">
 
@@ -326,6 +330,11 @@
 
         $('#client_id').select2();
         $('#client_policy_id').select2();
+        flatpickr("#claim_dump_date", {
+            dateFormat: "d/m/Y",
+            allowInput: false,
+            maxDate: "today"
+        });
 
         // AJAX Form Submit Function
         $('#claim-upload-form').on('submit', function(e) {
diff --git a/app/Views/claim_files_upload.php b/app/Views/claim_files_upload.php
index d2fe3ae8..6ea03e37 100644
--- a/app/Views/claim_files_upload.php
+++ b/app/Views/claim_files_upload.php
@@ -475,13 +475,19 @@
         }
     }
 
+    function claimFileIsLocalUpload(item) {
+        // file_type 2 = uploaded claim doc, 4 = merged combined PDF (both stored on disk)
+        return item.file_type == 2 || item.file_type === '2'
+            || item.file_type == 4 || item.file_type === '4';
+    }
+
     function claimFileViewSupported(item) {
         var mime = String(item.mime_type || '').toLowerCase();
         if (mime === 'application/pdf' || mime === 'image/png' || mime === 'image/jpeg') {
             return true;
         }
         var ext = '';
-        if (item.file_type == 2 || item.file_type === '2') {
+        if (claimFileIsLocalUpload(item)) {
             ext = claimFileListExtension(item.file_name) || claimFileListExtension(item.doc_name);
         } else {
             ext = claimFileListExtensionFromUrl(item.url);
@@ -493,12 +499,19 @@
     }
 
     function claimFileViewOpenUrl(item, base_url) {
-        if (item.file_type == 2 || item.file_type === '2') {
+        if (claimFileIsLocalUpload(item)) {
             return base_url + 'viewClaimFile/' + encodeURIComponent(item.id);
         }
         return String(item.url || '');
     }
 
+    function claimFileDownloadOpenUrl(item, base_url) {
+        if (claimFileIsLocalUpload(item)) {
+            return base_url + 'downloadClaimFile/' + encodeURIComponent(item.id);
+        }
+        return String(item.url || '');
+    }
+
     function create_url_list(data) {
         $('#table_bd').empty(); // clear existing rows
 
@@ -513,23 +526,20 @@
                 const tpaLabel = sentToTpa ? 'Yes' : 'No';
                 const viewOk = claimFileViewSupported(item);
                 const viewHref = escapeClaimFileListAttr(claimFileViewOpenUrl(item, base_url));
-                const viewSupportedAttr = viewOk ? '1' : '0';
-                const viewIconClass = viewOk ? 'text-primary' : 'text-muted';
-                const viewTitle = viewOk ? 'View in new tab' : 'Preview not available for this format';
+                const downloadHref = escapeClaimFileListAttr(claimFileDownloadOpenUrl(item, base_url));
+                const fileNameLinkHref = viewOk ? viewHref : downloadHref;
+                const fileNameLinkTitle = viewOk ? 'View in new tab' : 'Download';
                 html += `
                     <tr>
                         <td class="text-center">${index + 1}</td>
                         <td>${item.doc_name}</td>
-                        <td><a href="${item.url}" target="_blank">${item.file_type == 1 ? item.url : item.doc_name}</a></td>
+                        <td><a href="${fileNameLinkHref}" target="_blank" rel="noopener noreferrer" title="${fileNameLinkTitle}">${item.file_type == 1 ? item.url : item.doc_name}</a></td>
                         <td class="text-center">
                             <span class="badge ${tpaBadgeClass}" style="font-size:13px; padding:8px 12px; font-weight:600;">${tpaLabel}</span>
                         </td>
                         <td>
-                            <a href="javascript:void(0);" class="view-claim-file ${viewIconClass} mr-2" title="${viewTitle}"
-                                style="${viewOk ? '' : 'opacity:0.7;'}"
-                                data-view-url="${viewHref}"
-                                data-view-supported="${viewSupportedAttr}">
-                                <i class="mdi mdi-eye"></i>
+                            <a href="${downloadHref}" target="_blank" rel="noopener noreferrer" class="text-primary mr-2" title="Download">
+                                <i class="mdi mdi-download"></i>
                             </a>
                             <a href="javascript:void(0);" class="delete-url"
                             style="bacolor:black;"
@@ -547,19 +557,6 @@
         }
     }
 
-    $(document).on('click', '.view-claim-file', function (e) {
-        e.preventDefault();
-        var supported = $(this).data('view-supported') == 1 || $(this).data('view-supported') === '1';
-        var viewUrl = $(this).attr('data-view-url');
-        if (!supported) {
-            toastr.warning('Not supported format. Only PDF and images (PNG, JPG, JPEG) can be previewed.', 'View file');
-            return;
-        }
-        if (viewUrl) {
-            window.open(viewUrl, '_blank', 'noopener,noreferrer');
-        }
-    });
-
     $(document).on('click', '.delete-url', function (e) {
         e.preventDefault();
         const url = $(this).data('href');
diff --git a/app/Views/insurer_branch.php b/app/Views/insurer_branch.php
index 92494a03..9f40c732 100755
--- a/app/Views/insurer_branch.php
+++ b/app/Views/insurer_branch.php
@@ -21,6 +21,11 @@
 .is-invalid {
     border-color: #dc3545 !important;
 }
+
+/* Avoid duplicate validation messages: keep custom .field-error only */
+#insurer_branch_form .parsley-errors-list {
+    display: none !important;
+}
 </style>
 <!-- Optional CSS -->
 <style>
@@ -495,8 +500,15 @@
     }
 
     function getErrorElement($field) {
-        var $next = $field.next('.field-error');
-        if ($next.length) return $next;
+        var $group = $field.closest('.form-group');
+        var $existing = $group.find('.field-error');
+
+        if ($existing.length) {
+            if ($existing.length > 1) {
+                $existing.slice(1).remove();
+            }
+            return $existing.first();
+        }
 
         var $error = $('<small class="field-error"></small>');
         $field.after($error);
@@ -739,12 +751,18 @@
                 success: function(res) {
                     $("#insurer_branch_form")[0].reset();
                     console.log(res);
+                    if (res && res.status) {
+                        toastr.success(res.message || 'Insurer branch saved successfully', 'Success');
+                        window.location.reload();
+                        return;
+                    }
+
                     $('#insurer_branch_list tr').remove();
                     renderBranchRows(res.data || []);
                     initBranchDataTable();
                     $('#container').empty(); $('#contact_1_wrapper input').val('');
                     hideBranchModal();
-                    // window.location.reload();
+                    toastr.warning((res && res.message) ? res.message : 'Unable to save insurer branch', 'Warning');
                     // $('#add_branch').hide();
                     // $('#branch_table').show();
                     // $('.btnBack').hide();
diff --git a/app/Views/rto_master_list.php b/app/Views/rto_master_list.php
index e5b2b2dd..57214d5e 100644
--- a/app/Views/rto_master_list.php
+++ b/app/Views/rto_master_list.php
@@ -170,10 +170,12 @@ $rto_col_width_px = nhance_dt_column_widths_px($rto_header_labels, $rto_col_max_
                                     placeholder="Enter RTO State" style="text-transform:uppercase"
                                     required
                                     data-parsley-required-message="RTO State is required"
-                                    data-parsley-type="alpha"
-                                    data-parsley-type-message="RTO State must contain only alphabets"
-                                    data-parsley-length="[2,2]"
-                                    data-parsley-length-message="RTO State must be exactly 2 letters"
+                                    data-parsley-pattern="^[a-zA-Z\s]+$"
+                                    data-parsley-pattern-message="RTO State must contain only alphabets and spaces"
+                                    data-parsley-minlength="2"
+                                    data-parsley-minlength-message="RTO State must be at least 2 characters"
+                                    data-parsley-maxlength="50"
+                                    data-parsley-maxlength-message="RTO State maximum 50 characters"
                                     data-parsley-trigger="keyup">
                             </div>
 
@@ -289,7 +291,7 @@ $rto_col_width_px = nhance_dt_column_widths_px($rto_header_labels, $rto_col_max_
         } else if (type == 'edit'){  
             method = "GET";
             $('#modalLabel').text('Edit RTO details');
-            $('#vehicleTypeForm')[0].reset();
+            $('#RTOForm')[0].reset();
         }
 
         console.log("type", type)
diff --git a/app/Views/swagger/index.php b/app/Views/swagger/index.php
index 865b2a23..6ec0d909 100755
--- a/app/Views/swagger/index.php
+++ b/app/Views/swagger/index.php
@@ -4,7 +4,7 @@
 
 <head>
   <meta charset="UTF-8">
-  <title>Swagger UI</title>
+  <title><?= esc($pageTitle ?? 'Swagger UI') ?></title>
   <link rel="stylesheet" type="text/css" href="<?= base_url('assets/swagger/swagger-ui.css') ?>">
   <link rel="icon" type="image/png" href="<?= base_url('assets/swagger/favicon-32x32.png') ?> sizes=" 32x32" />
   <link rel="icon" type="image/png" href="<?= base_url('assets/swagger/favicon-16x16.png') ?> sizes=" 16x16" />
@@ -31,15 +31,15 @@
 <body>
   <div id="swagger-ui"></div>
 
-  <script src="<?= base_url('assets/swagger/swagger-ui-bundle.js') ?>">console.log(base_url); </script>
-  <script src="<?= base_url('assets/swagger/swagger-ui-standalone-preset.js') ?>"> </script>
+  <script src="<?= base_url('assets/swagger/swagger-ui-bundle.js') ?>"></script>
+  <script src="<?= base_url('assets/swagger/swagger-ui-standalone-preset.js') ?>"></script>
   <script>
     window.onload = function() {
-      // Begin Swagger UI call region
       const ui = SwaggerUIBundle({
-        url: "<?= base_url('assets/api.yaml') ?>",
+        url: "<?= esc($specUrl ?? base_url('assets/api.yaml'), 'js') ?>",
         dom_id: '#swagger-ui',
         deepLinking: true,
+        persistAuthorization: true,
         presets: [
           SwaggerUIBundle.presets.apis,
           SwaggerUIStandalonePreset
@@ -48,12 +48,28 @@
           SwaggerUIBundle.plugins.DownloadUrl
         ],
         layout: "StandaloneLayout"
-      })
-      // End Swagger UI call region
+      });
 
-      window.ui = ui
-    }
+      window.ui = ui;
 
+      <?php if (! empty($swaggerPreauthorize)): ?>
+      try {
+        <?php foreach ($swaggerPreauthorize as $row): ?>
+          <?php if (($row['kind'] ?? '') === 'apiKey'): ?>
+        if (typeof ui.preauthorizeApiKey === 'function') {
+          ui.preauthorizeApiKey(<?= json_encode($row['scheme'] ?? '') ?>, <?= json_encode($row['value'] ?? '') ?>);
+        }
+          <?php elseif (($row['kind'] ?? '') === 'basic'): ?>
+        if (typeof ui.preauthorizeBasic === 'function') {
+          ui.preauthorizeBasic(<?= json_encode($row['scheme'] ?? '') ?>, <?= json_encode($row['username'] ?? '') ?>, <?= json_encode($row['password'] ?? '') ?>);
+        }
+          <?php endif; ?>
+        <?php endforeach; ?>
+      } catch (e) {
+        console.warn('Swagger preauthorize', e);
+      }
+      <?php endif; ?>
+    };
   </script>
 </body>
 
diff --git a/app/Views/ticket_list.php b/app/Views/ticket_list.php
index 2c9d513c..6f1d3cd7 100644
--- a/app/Views/ticket_list.php
+++ b/app/Views/ticket_list.php
@@ -251,7 +251,7 @@ table.dataTable tbody td {
 
                                         echo $policyTypeIconHtml . esc($policyTypeLabel);
                                         if ($claimSrcClass !== null) {
-                                            echo '<br><span class="claim-source-badge ' . esc($claimSrcClass, 'attr') . '">' . esc($claimSrc) . '</span>';
+                                            echo '<br><span class="claim-source-badge ' . esc($claimSrcClass, 'attr') . '">' . esc($claimSrc == "CRM" ? "STAFF" : $claimSrc) . '</span>';
                                         }
                                         ?></td>
                                     <td><?php echo $row['claim_no'] ?: 'N/A' ; ?>
diff --git a/openapi/tpa-external-integrations.yaml b/openapi/tpa-external-integrations.yaml
new file mode 100644
index 00000000..af8fc6b0
--- /dev/null
+++ b/openapi/tpa-external-integrations.yaml
@@ -0,0 +1,922 @@
+openapi: 3.0.3
+info:
+  title: Nhance — TPA external API integrations
+  description: |
+    OpenAPI description of **outbound** HTTP calls made by Nhance to third-party TPA systems.
+    Base URLs and credentials come from environment variables (see **Authorize** / security schemes below).
+    This is **not** the public REST API of the Nhance application itself.
+
+    Controllers: `MediAssistApiController`, `VidalApiController`, `VoloApiController`,
+    `FhplApiController`, `HealthIndiaApiController`.
+
+    **Credentials (.env)** — use the same variable names as `getenv()` / `env()` in PHP:
+    MediAssist: `MEDI_ASSIST_API_USERNAME`, `MEDI_ASSIST_API_PASSWORD`; URLs: `MEDI_ASSIST_API_BASE_URL_*`.
+    Vidal: `VIDAL_API_SUBSCRIPTION_KEY`, `VIDAL_SUBSCRIPTION_KEY` (IR only), `VIDAL_WELLNESS_SUBSCRIPTION_KEY`; base `VIDAL_API_BASE_URL`.
+    Volo login: `VOLO_API_EMAIL`, `VOLO_API_PASSWORD`, `VOLO_LOGGED_IN_PORTAL`; bases `VOLO_API_ADMIN_BASE_URL`, `VOLO_API_CONSUMER_BASE_URL`.
+    FHPL: `FHPL_TOKEN_URL`, `FHPL_USER_NAME`, `FHPL_PASSWORD`, `FHPL_GRANT_TYPE`; API `FHPL_BASE_URL`.
+    Health India: `HEALTH_INDIA_TOKEN_URL`, `HEALTH_INDIA_USERNAME`, `HEALTH_INDIA_PASSWORD`; API `HEALTH_INDIA_BASE_URL`.
+  version: 1.0.0
+
+tags:
+  - name: MediAssist
+  - name: Vidal
+  - name: Volo
+  - name: FHPL
+  - name: HealthIndia
+
+servers:
+  - url: https://example.invalid
+    description: >
+      Default placeholder only. Each TPA uses its own base URL from environment variables;
+      many MediAssist endpoints use a full URL per env var (see operation descriptions).
+
+# ----------------------------------------------------------------------------
+# MediAssist — servers vary per env var (often full URL including path).
+# Default hosts shown are illustrative; override via env.
+# ----------------------------------------------------------------------------
+paths:
+
+  /mediassist/claim-submit:
+    post:
+      tags: [MediAssist]
+      security:
+        - MediAssistUsername: []
+          MediAssistPassword: []
+      summary: Submit claim (claim push)
+      description: |
+        URL from `MEDI_ASSIST_API_BASE_URL_CLAIMSUBMIT` (full URL).
+        Headers `Username` / `Password` from `MEDI_ASSIST_API_USERNAME` / `MEDI_ASSIST_API_PASSWORD`.
+      operationId: mediassistSubmitClaim
+      servers:
+        - url: https://apiintegration.mediassist.in
+          description: Example host — replace with env URL
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MediAssistSubmitClaimBody'
+      responses:
+        '200':
+          description: Wrapped by app helper; success includes `claimReferenceNo` in nested payload
+
+  /mediassist/ecard:
+    post:
+      tags: [MediAssist]
+      security:
+        - MediAssistUsername: []
+          MediAssistPassword: []
+      summary: E-card URL request
+      description: URL from `MEDI_ASSIST_API_BASE_URL_ECARDREQUEST`.
+      operationId: mediassistEcardRequest
+      servers:
+        - url: https://apiintegration.mediassist.in
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [employeeId, policyNo]
+              properties:
+                employeeId: { type: string }
+                policyNo: { type: string }
+      responses:
+        '200':
+          description: Response includes `ecardUrl` when successful
+
+  /mediassist/benef-details:
+    post:
+      tags: [MediAssist]
+      security:
+        - MediAssistUsername: []
+          MediAssistPassword: []
+      summary: Get beneficiary / enrollment (TPA ID pull)
+      description: URL from `MEDI_ASSIST_API_BASE_URL_FETCHTPA`. Paginated with `startIndex` / `range`.
+      operationId: mediassistGetBenefDetails
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [policyNo]
+              properties:
+                policyNo: { type: string }
+                startDate: { type: string, default: "" }
+                endDate: { type: string, default: "" }
+                isDeActivedata: { type: boolean, default: false }
+                startIndex: { type: integer }
+                range: { type: integer, example: 100 }
+                employeeId: { type: string, default: "" }
+      responses:
+        '200':
+          description: Expects `benefDetails` and `count` in data
+
+  /mediassist/claim-status:
+    post:
+      tags: [MediAssist]
+      security:
+        - MediAssistUsername: []
+          MediAssistPassword: []
+      summary: Claim status / claims data
+      description: URL from `MEDI_ASSIST_API_BASE_URL_CLAIMSTATUS`.
+      operationId: mediassistClaimStatus
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MediAssistClaimStatusBody'
+      responses:
+        '200':
+          description: Expects `claimsData` array in response data
+
+  /mediassist/ir-submission:
+    post:
+      tags: [MediAssist]
+      security:
+        - MediAssistUsername: []
+          MediAssistPassword: []
+      summary: IR (information) submission with attachment URLs
+      description: URL from `MEDI_ASSIST_API_BASE_URL_IRSUBMISSION`.
+      operationId: mediassistIRSubmission
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [ClaimID, Attachments]
+              properties:
+                ClaimID: { type: string }
+                Attachments:
+                  type: array
+                  items:
+                    type: object
+                    properties:
+                      AttachmentName: { type: string }
+                      AttachmentPath: { type: string, description: Public download URL }
+      responses:
+        '200':
+          description: App treats `status` from helper as success/failure
+
+  /mediassist/network-hospital:
+    post:
+      tags: [MediAssist]
+      security:
+        - MediAssistUsername: []
+          MediAssistPassword: []
+      summary: Network hospital list
+      description: |
+        Built as `{MEDI_ASSIST_API_BASE_URL}/NetworkHospital` (env base + path).
+      operationId: mediassistNetworkHospital
+      requestBody:
+        content:
+          application/json:
+            example:
+              startIndex: 0
+              endIndex: 10
+              policyNumber: "97000063250400000031"
+      responses:
+        '200':
+          description: Third-party response passed through
+
+  /mediassist/intimate-claim:
+    post:
+      tags: [MediAssist]
+      security:
+        - MediAssistUsername: []
+          MediAssistPassword: []
+      summary: Intimate claim (UAT sample in code)
+      description: |
+        **Note:** `IntimateClaim()` in code uses a hardcoded URL and test credentials;
+        production should use env-driven URL and secrets.
+      operationId: mediassistIntimateClaimDev
+      deprecated: true
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                Username: { type: string }
+                Password: { type: string }
+                policyNo: { type: string }
+                memberId: { type: number }
+                DateOfAdmisssion: { type: string, format: date }
+                HospitalName: { type: string }
+                AilmentDescription: { type: string }
+                ContactNo: { type: string }
+
+  # --------------------------------------------------------------------------
+  # Vidal Health TPA (Azure APIM)
+  # --------------------------------------------------------------------------
+  /partner-integration/api/files/upload-url:
+    post:
+      tags: [Vidal]
+      security:
+        - VidalSubscriptionKey: []
+      summary: Get signed URL for document upload
+      description: |
+        `VIDAL_API_BASE_URL` + `/files/upload-url`.
+        Header `Ocp-Apim-Subscription-Key` = `VIDAL_API_SUBSCRIPTION_KEY`.
+        Second step uploads file via PUT to returned `signedUrl` (Azure Blob).
+      operationId: vidalFileUploadUrl
+      servers:
+        - url: https://devapigw.vidalhealthtpa.com
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                scope: { type: string, example: document type }
+                fileName: { type: string }
+      responses:
+        '200':
+          description: Expects `data.signedUrl`, `data.fileId`
+
+  /partner-integration/api/claims/submit:
+    post:
+      tags: [Vidal]
+      security:
+        - VidalSubscriptionKey: []
+      summary: Submit claim
+      operationId: vidalClaimsSubmit
+      servers:
+        - url: https://devapigw.vidalhealthtpa.com
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/VidalClaimSubmitBody'
+      responses:
+        '200':
+          description: Success path checks `data.status == SUCCESS` and nested claim numbers
+
+  /partner-integration/api/claims/claim-dependent-info:
+    post:
+      tags: [Vidal]
+      security:
+        - VidalSubscriptionKey: []
+      summary: Claim dependent info / status poll
+      operationId: vidalClaimDependentInfo
+      servers:
+        - url: https://devapigw.vidalhealthtpa.com
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                empNO: { type: string, default: "" }
+                tpaCardID: { type: string, default: "" }
+                claimID: { type: string, description: Set when known }
+                emailID: { type: string, default: "" }
+                mobileNO: { type: string, default: "" }
+      responses:
+        '200':
+          description: Expects `data.data.claims[]`
+
+  /partner-integration/enrollment/info:
+    post:
+      tags: [Vidal]
+      security:
+        - VidalSubscriptionKey: []
+      summary: Enrollment / beneficiary pull (Vidal V2)
+      description: |
+        URL from `vidalEnrollmentInfoApiUrl()`: strips trailing `/api` from `VIDAL_API_BASE_URL`
+        and appends `/enrollment/info`, or falls back to dev URL.
+        Paginates with `startIndex` / `endIndex`.
+      operationId: vidalEnrollmentInfo
+      servers:
+        - url: https://devapigw.vidalhealthtpa.com
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                policyNo: { type: string }
+                startIndex: { type: integer, example: 1 }
+                endIndex: { type: integer, example: 100 }
+
+  /vidal/wellness-sso:
+    post:
+      tags: [Vidal]
+      security:
+        - VidalWellnessSubscriptionKey: []
+      summary: Wellness SSO (encrypted payload)
+      description: |
+        `VIDAL_WELLNESS_BASE_URL`. Headers include `Ocp-Apim-Subscription-Key`,
+        `apiver`, `mode: encrypt`. Body uses AES-encrypted payload + `source` / `subPartnerId`.
+      operationId: vidalWellnessSSO
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                payload: { type: string, description: iv:ciphertext base64 format }
+                source: { type: string }
+                subPartnerId: { type: string }
+
+  /vidal/ir-submission:
+    post:
+      tags: [Vidal]
+      security:
+        - VidalIrSubscriptionKey: []
+      summary: IR submission (shortfall documents)
+      description: |
+        Full URL from `VIDAL_API_BASE_URL_IRSUBMISSION`.
+        Uses `VIDAL_SUBSCRIPTION_KEY` (note distinct from `VIDAL_API_SUBSCRIPTION_KEY` in code).
+        Body sent as JSON string in some call paths.
+      operationId: vidalIRSubmission
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                shortFallNo: { type: string }
+                fileId: { type: string, description: Single file }
+                fileIdList:
+                  type: array
+                  items: { type: string }
+                  description: Multiple files
+
+  # --------------------------------------------------------------------------
+  # Volo / TrueCover (admin + consumer bases)
+  # --------------------------------------------------------------------------
+  /external/login:
+    post:
+      tags: [Volo]
+      security: []
+      summary: Login — obtain access token
+      description: |
+        `VOLO_API_ADMIN_BASE_URL` + `/external/login`.
+        Body uses `VOLO_API_EMAIL`, `VOLO_API_PASSWORD`, `VOLO_LOGGED_IN_PORTAL`.
+      operationId: voloLogin
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                emailId: { type: string }
+                password: { type: string }
+                loggedInPortal:
+                  type: string
+                  example: POLICY_CONFIGURATION_PORTAL
+      responses:
+        '200':
+          description: Expects `accessToken` for Authorization header on subsequent calls
+
+  /trueclaim/tpa/get-Enrollment-dump:
+    get:
+      tags: [Volo]
+      security:
+        - VoloBearerToken: []
+      summary: Enrollment dump by endorsement
+      operationId: voloGetEnrollmentDumpByEndorsement
+      parameters:
+        - in: query
+          name: insurerPolicyNumber
+          required: true
+          schema: { type: string }
+        - in: query
+          name: endorsmentNo
+          required: true
+          schema: { type: string }
+
+  /trueclaim/tpa/getHospitalByInsurerName:
+    get:
+      tags: [Volo]
+      security:
+        - VoloBearerToken: []
+      summary: Hospitals by insurer name
+      operationId: voloGetHospitalByInsurerName
+      parameters:
+        - in: query
+          name: insurerName
+          required: true
+          schema: { type: string }
+
+  /trueclaim/tpa/doc:
+    post:
+      tags: [Volo]
+      security:
+        - VoloBearerToken: []
+      summary: Upload document (body defined by TPA)
+      operationId: voloUploadDocument
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: true
+
+  /trueclaim/tpa/get-Enroll-dump:
+    get:
+      tags: [Volo]
+      security:
+        - VoloBearerToken: []
+      summary: Enrollment dump by insurer policy number
+      operationId: voloGetEnrollmentDump
+      parameters:
+        - in: query
+          name: insurerPolicyNumber
+          required: true
+          schema: { type: string }
+
+  /truecover/external-service/claim-status:
+    post:
+      tags: [Volo]
+      security:
+        - VoloBearerToken: []
+      summary: External claim status (consumer base)
+      description: |
+        `VOLO_API_CONSUMER_BASE_URL` + `/truecover/external-service/claim-status`.
+      operationId: voloFetchExternalClaimStatus
+      servers:
+        - url: https://consumer.example.ewatpa.com
+          description: Replace with VOLO_API_CONSUMER_BASE_URL
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [tpaClaimNo]
+              properties:
+                tpaClaimNo: { type: string }
+
+  /trueclaim/tpa/getTpaData:
+    post:
+      tags: [Volo]
+      security:
+        - VoloBearerToken: []
+      summary: TPA data by date range and entity
+      operationId: voloGetTpaData
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [startDate, endDate, entityId]
+              properties:
+                startDate: { type: string }
+                endDate: { type: string }
+                entityId: { type: string }
+
+  /trueclaim/create-new-all-member-id-card-pdf:
+    get:
+      tags: [Volo]
+      security:
+        - VoloBearerToken: []
+      summary: E-card PDF (base64 in response body)
+      operationId: voloGetEcardPdf
+      parameters:
+        - in: query
+          name: employeeId
+          required: true
+          schema: { type: string }
+        - in: query
+          name: entityId
+          required: true
+          schema: { type: string }
+
+  /trueclaim/get-entity-from-policy:
+    get:
+      tags: [Volo]
+      security:
+        - VoloBearerToken: []
+      summary: Resolve entity id from policy number
+      operationId: voloGetEntityFromPolicy
+      parameters:
+        - in: query
+          name: policyNumber
+          required: true
+          schema: { type: string }
+
+  /trueclaim/policy-bazaar/intimate-claim:
+    post:
+      tags: [Volo]
+      security:
+        - VoloBearerToken: []
+      summary: Intimate claim (claim push)
+      description: |
+        Built payload includes `hospitalId` (`VOLO_DEFAULT_HOSPITAL_ID`), `memberId`,
+        dates, `potentialClaimAmount`, `claimDocuments` (pdf URL), `entityId`, `insurerPolicyNumber`.
+      operationId: voloIntimateClaim
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/VoloIntimateClaimBody'
+
+  /trueclaim/tpa/getClaimData:
+    post:
+      tags: [Volo]
+      security:
+        - VoloBearerToken: []
+      summary: Get claim data
+      operationId: voloGetClaimData
+      parameters:
+        - in: query
+          name: claimId
+          required: true
+          schema: { type: string }
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              description: Empty JSON object sent as body
+
+  # --------------------------------------------------------------------------
+  # FHPL
+  # --------------------------------------------------------------------------
+  /oauth/token:
+    get:
+      tags: [FHPL]
+      security: []
+      summary: Generate OAuth token
+      description: |
+        URL from `FHPL_TOKEN_URL`. **Note:** implementation uses GET with `application/x-www-form-urlencoded`
+        body (`UserName`, `Password`, `grant_type`) — align with FHPL spec / Postman.
+      operationId: fhplGenerateToken
+      requestBody:
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              properties:
+                UserName: { type: string }
+                Password: { type: string }
+                grant_type: { type: string }
+
+  /api/ClaimSubmission:
+    post:
+      tags: [FHPL]
+      summary: Claim submission
+      description: |
+        `{FHPL_BASE_URL}/api/ClaimSubmission` with Bearer token from token endpoint.
+      operationId: fhplClaimSubmission
+      security:
+        - FhplBearerAuth: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/FhplClaimSubmissionBody'
+
+  /api/GetTPA_ClaimsDetails:
+    post:
+      tags: [FHPL]
+      summary: TPA claim details / MIS (status sync)
+      operationId: fhplGetTpaClaimsDetails
+      security:
+        - FhplBearerAuth: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                UserName: { type: string }
+                Password: { type: string }
+                PolicyNumber: { type: string }
+                Fromdate: { type: string, format: date }
+                Todate: { type: string, format: date }
+
+  /api/GetEcard:
+    post:
+      tags: [FHPL]
+      summary: Get e-card URL
+      operationId: fhplGetEcard
+      security:
+        - FhplBearerAuth: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                UserName: { type: string }
+                Password: { type: string }
+                PolicyNumber: { type: string }
+                EmployeeID: { type: string }
+
+  /api/GetEnrollmentDetailsPolicy:
+    post:
+      tags: [FHPL]
+      summary: Enrollment details for policy (paginated)
+      operationId: fhplGetEnrollmentDetailsPolicy
+      security:
+        - FhplBearerAuth: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                UserName: { type: string }
+                Password: { type: string }
+                PolicyNumber: { type: string }
+                StartIndex: { type: integer }
+                Range: { type: integer, example: 100 }
+
+  # --------------------------------------------------------------------------
+  # Health India TPA
+  # --------------------------------------------------------------------------
+  /JWT/GenerateJWTAuth:
+    post:
+      tags: [HealthIndia]
+      summary: Generate JWT (Basic auth)
+      description: |
+        `HEALTH_INDIA_TOKEN_URL`. HTTP Basic with `HEALTH_INDIA_USERNAME` / `HEALTH_INDIA_PASSWORD`.
+        Body is `{}`.
+      operationId: healthIndiaGenerateJWT
+      security:
+        - HealthIndiaTokenBasic: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+
+  /Intimation/GetClaimIntimation:
+    post:
+      tags: [HealthIndia]
+      summary: Claim intimation / reimbursement submission
+      description: >
+        HEALTH_INDIA_BASE_URL + /Intimation/GetClaimIntimation
+      operationId: healthIndiaClaimIntimation
+      security:
+        - HealthIndiaBearerAuth: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/HealthIndiaClaimIntimationBody'
+
+  /Claims/GetClaims:
+    post:
+      tags: [HealthIndia]
+      summary: Get claim(s) by CCN
+      operationId: healthIndiaGetClaims
+      security:
+        - HealthIndiaBearerAuth: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                policY_NUMBER: { type: string }
+                CCN: { type: string }
+                CCN_EXT: { type: string }
+
+  /Member/GetMemberEcard:
+    post:
+      tags: [HealthIndia]
+      summary: Member e-card
+      operationId: healthIndiaGetMemberEcard
+      security:
+        - HealthIndiaBearerAuth: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                policY_NUMBER: { type: string }
+                employeE_CODE: { type: string }
+                membeR_ID: { type: string }
+
+  /Enrollment/GetEnrollmentData:
+    post:
+      tags: [HealthIndia]
+      summary: Bulk enrollment data (TPA ID pull)
+      operationId: healthIndiaGetEnrollmentData
+      security:
+        - HealthIndiaBearerAuth: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                policY_NUMBER: { type: string }
+
+  /ClaimsMIS/GetClaimsMIS:
+    post:
+      tags: [HealthIndia]
+      summary: Claims MIS / sync
+      operationId: healthIndiaGetClaimsMIS
+      security:
+        - HealthIndiaBearerAuth: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                policY_NUMBER: { type: string }
+
+components:
+  securitySchemes:
+    MediAssistUsername:
+      type: apiKey
+      in: header
+      name: Username
+      description: |
+        `.env`: `MEDI_ASSIST_API_USERNAME` — same value as `getenv('MEDI_ASSIST_API_USERNAME')` in PHP.
+
+    MediAssistPassword:
+      type: apiKey
+      in: header
+      name: Password
+      description: |
+        `.env`: `MEDI_ASSIST_API_PASSWORD` — same value as `getenv('MEDI_ASSIST_API_PASSWORD')`.
+
+    VidalSubscriptionKey:
+      type: apiKey
+      in: header
+      name: Ocp-Apim-Subscription-Key
+      description: |
+        `.env`: `VIDAL_API_SUBSCRIPTION_KEY` — used for partner-integration APIs (`VIDAL_API_BASE_URL`).
+
+    VidalIrSubscriptionKey:
+      type: apiKey
+      in: header
+      name: Ocp-Apim-Subscription-Key
+      description: |
+        `.env`: `VIDAL_SUBSCRIPTION_KEY` — used **only** for IR submission (`VIDAL_API_BASE_URL_IRSUBMISSION`).
+        Same header name as main Vidal key but different secret.
+
+    VidalWellnessSubscriptionKey:
+      type: apiKey
+      in: header
+      name: Ocp-Apim-Subscription-Key
+      description: |
+        `.env`: `VIDAL_WELLNESS_SUBSCRIPTION_KEY`. Wellness also uses `VIDAL_WELLNESS_BASE_URL`,
+        `VIDAL_WELLNESS_BASE64_KEY`, `VIDAL_WELLNESS_URL_IDENTIFIER`, `VIDAL_WELLNESS_SUB_PARTNER_ID`.
+
+    VoloBearerToken:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+      description: |
+        Obtain token from `POST .../external/login` using body fields from `.env`:
+        `VOLO_API_EMAIL`, `VOLO_API_PASSWORD`, `VOLO_LOGGED_IN_PORTAL`.
+        Send the returned `accessToken` as the Bearer value (as required by the API, sometimes including a `Token ` prefix).
+
+    FhplBearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+      description: |
+        Bearer `access_token` returned from `FHPL_TOKEN_URL` using form fields
+        `UserName`=`FHPL_USER_NAME`, `Password`=`FHPL_PASSWORD`, `grant_type`=`FHPL_GRANT_TYPE`.
+
+    HealthIndiaTokenBasic:
+      type: http
+      scheme: basic
+      description: |
+        For JWT generation call only. `.env`: `HEALTH_INDIA_USERNAME`, `HEALTH_INDIA_PASSWORD`
+        (HTTP Basic to `HEALTH_INDIA_TOKEN_URL`).
+
+    HealthIndiaBearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+      description: |
+        Bearer JWT from the GenerateJWTAuth response (not a fixed `.env` value).
+        Use `result[0].access_token` after calling token URL with Basic credentials above.
+
+  schemas:
+    MediAssistSubmitClaimBody:
+      type: object
+      properties:
+        policyNo: { type: string }
+        memberId: { type: string }
+        mobileNo: { type: string }
+        emailId: { type: string }
+        claimDateOfAdmission: { type: string }
+        claimDateOfDischarge: { type: string }
+        hospName: { type: string }
+        hospAddress: { type: string }
+        reasonForHospitalization: { type: string }
+        disease: { type: string }
+        claimAmount: { type: number }
+        claimType:
+          type: string
+          example: HOSPITALIZATION
+        claimSubmissionAttachments:
+          type: object
+          properties:
+            fileName: { type: string }
+            filePath: { type: string, description: Public URL to PDF }
+
+    MediAssistClaimStatusBody:
+      type: object
+      properties:
+        policyNo: { type: string }
+        startDate: { type: string }
+        endDate: { type: string }
+        employeeCode: { type: string }
+        memberID: { type: string }
+        claimNo: { type: string }
+        claimRefNo: { type: string }
+
+    VidalClaimSubmitBody:
+      type: object
+      properties:
+        policyNo: { type: string }
+        dependentUniqueId: { type: string }
+        typeOfClaim: { type: string, example: Main hospitalization claim }
+        claimSubType: { type: string }
+        requestedAmount: { type: string }
+        ailmentType: { type: string, example: Non covid }
+        admissionDate: { type: string, description: dd-mm-yyyy }
+        dischargeDate: { type: string }
+        hospitalName: { type: string }
+        empanelmentNo: { type: number }
+        ailmentName: { type: string }
+        hospitalAddress: { type: string, nullable: true }
+        hospitalState: { type: string, nullable: true }
+        hospitalCity: { type: string, nullable: true }
+        hospitalPinCode: { type: string, nullable: true }
+        hospitalPhoneNo: { type: string, nullable: true }
+        fileId: { type: string }
+        bankDetails:
+          type: object
+          properties:
+            accountHolderName: { type: string, nullable: true }
+            accountType: { type: string, nullable: true }
+            accountNo: { type: string, nullable: true }
+            ifscCode: { type: string, nullable: true }
+
+    VoloIntimateClaimBody:
+      type: object
+      properties:
+        hospitalId: { type: string }
+        memberId: { type: string }
+        dateOfAdmission: { type: string, format: date }
+        dateOfDischarge: { type: string, format: date }
+        potentialClaimAmount: { type: number }
+        claimDocuments:
+          type: array
+          items:
+            type: object
+            properties:
+              documentName: { type: string }
+              documentType: { type: string, example: medical_report }
+              extension: { type: string, example: pdf }
+              url: { type: string, format: uri }
+        entityId: { type: string }
+        insurerPolicyNumber: { type: string }
+
+    FhplClaimSubmissionBody:
+      type: object
+      properties:
+        IssueID: { type: string }
+        Userid:
+          type: string
+          description: Same as `.env` `FHPL_USER_NAME` where the app sends Userid.
+        PolicyNo: { type: string }
+        UhidNo: { type: string }
+        ClaimID: { type: string }
+        DOA: { type: string, format: date }
+        DateofDischarge: { type: string, format: date, nullable: true }
+        ClaimedAmount: { type: number }
+        DocumentType: { type: integer, example: 20, description: Fresh claim }
+        PayeeName: { type: string }
+        HospitalName: { type: string }
+        MobileNo: { type: string }
+        Documents:
+          type: array
+          items:
+            type: object
+            properties:
+              documentName: { type: string }
+              documentCategory: { type: string, example: IRR }
+              filecontent: { type: string, description: Base64 PDF }
+
+    HealthIndiaClaimIntimationBody:
+      type: object
+      description: Field casing matches Health India API (mixedCase keys).
+      properties:
+        policY_NUMBER: { type: string }
+        employeE_CODE: { type: string }
+        membeR_ID: { type: string }
+        claiM_TYPE: { type: string, example: Reimbursement }
+        benefiT_TYPE: { type: string, enum: [IPD, OPD] }
+        claimeD_AMOUNT: { type: string }
+        datE_OF_ADMISSION: { type: string, format: date }
+        ailmenT_DESCRIPTION: { type: string }
+        hospitaL_CODE: { type: string }
+        hospitaL_NAME: { type: string }
+        hospitaL_ADDRESS: { type: string }
+        hospitaL_NUMBER: { type: string }
+        pdF_BYTES:
+          type: array
+          items: { type: string, description: Base64-encoded PDF }