This documentation supports the 20.08 and consecutive patch versions of BMC Helix Business Workflows.

To view the documentation for the previous version, select 20.02 from the Product version menu.

Whitelisting HTML tags and domains

You can add images, tables, and links to your emails and notification templates. Out-of-the-box, the underlying HTML tags and their attributes are whitelisted in BMC Helix Business Workflows. This enables users to view the images, tables, and hyperlinks in emails, notification templates, and activity feed. For links or images from a website, an administrator must whitelist the domain of the website.

Emails and notification templates use the BMC Helix Platform email engine. To ensure security, the BMC Helix Platform email engine only displays the URLs and images from a website if the domain is included in the whitelist.

The following HTML tags and the attributes are whitelisted out-of-the-box for images and tables:


As an administrator, you can add or modify existing attributes for the images and tables. The HTML tags and domains that are not present in the whitelist are suppressed from the email messages and activity feed.

For example, if you whitelist the HTML tag and its attributes for videos, the video is displayed in the email that is sent. If the HTML tag for videos is not whitelisted, the video is suppressed from the email message.

To whitelist HTML tags, attributes, and domains in BMC Helix Business Workflows

  1. Log in to BMC Helix Business Workflows as an administrator.
  2. Click My Application Settings .
    The Settings page opens in a new browser tab.
  3.  Click Application Configuration > Whitelist Configuration.
  4. In the Override/Additional HTML Tags, add a comma-separated list of the tags and related attributes.


    If your email client does not support base64 image, it will not be displayed even after you whitelist it. For more information about the format, see Configuring email profiles and templates .

    Any new attribute that you add to an existing list is appended to the list. Any change to the existing attributes overrides the existing list.

  5. In the Whitelist domain names field, enter the domains in a comma-separated list from which links and images should be displayed in the email, notification, or activity feed.


    Add the base domain without www. For example, add instead of

    The following image shows an example of whitelisting an HTML tag, its attributes, and a domain.

  6. Click Save.

Was this page helpful? Yes No Submitting... Thank you