Some external APIs (like Duolingo) don't properly decode URL-encoded path parameters.
When Assembled passes email addresses like
test_example@duolingo.com
, they become
test_example%40duolingo.com
, causing 404 errors.
Proposal: Add a checkbox in Domain Management to disable URL encoding for path parameters:
URL-encode path parameters (enabled by default)
This would support edge-case APIs while maintaining security best practices by default.
Impact:
  • Duolingo currently blocked from using email lookups
  • Potential benefit for other customers with non-standard APIs