RevoEngine Documentation

Transport is the integration boundary for file and byte movement. It does not own files, folders, retention, or permissions: storage.* does. HTTP and SFTP use the same Storage namespace and ACL path, so a transfer receives exactly the access that its executing identity has in Storage.

HTTP

Use api.httpCall() for external API requests, streamed request bodies, and streamed response targets.

SFTP

Use transport.sftpImport(), transport.sftpExport(), and transport.sftpCommands() for managed SFTP connections.

One Storage authorization model

Every Storage source and target follows this rule:

{ storageEntryId, namespace?: string }

For a new target, place namespace beside the normal create-upload fields:

{
  namespace: 'agents',
  parentStorageEntryId: workspaceFolderId,
  name: 'daily.csv',
  contentTypeHint: 'text/csv'
}

Omit namespace for explorer. A provided namespace is not a permission grant: Storage validates its registered namespace policy, the current execution identity, restricted ancestors, and entry ACL. This applies equally to private/<userId>, agent workspaces, managed attachments, media, and reports. Read-only or managed namespaces still reject writes when their Storage policy says so.

Do not replace a Storage check with a namespace check. A transfer never bypasses ACL; a component, Job, Agent, or administrator can act only within the scope Storage authorizes for that execution.

HTTP streaming

Use api.httpCall() to send an existing Storage file without buffering it in the component:

const result = await api.httpCall(
  {
    url: 'https://partner.example.com/v1/import',
    method: 'POST',
    headers: { Authorization: `Bearer ${await api.getSecret('PARTNER_API_KEY')}` },
  },
  {
    requestType: 'stream',
    responseType: 'storage',
    source: { storageEntryId: inputFileId, namespace: 'agents' },
    target: {
      namespace: 'agents',
      parentStorageEntryId: outputFolderId,
      name: 'result.csv',
      contentTypeHint: 'text/csv',
    },
  },
);

return result.storage.entry;

For a full HTTP contract, status handling, form-data, SSE, and direct upload-session targets, see HTTP and Storage.

SFTP

The third argument is an active Secret name, normally a human-readable name such as SFTP_PRODUCTION. A UUID is also accepted. The Secret is resolved through its unique name index or primary key; credentials never enter low-code source.

Connection Secret formats

Password authentication may use flat JSON:

{
  "host": "sftp.example.com",
  "port": 22,
  "username": "integration",
  "password": "..."
}

or a connection string:

sftp://integration:password@sftp.example.com:22

Use flat JSON for a private key:

{
  "host": "sftp.example.com",
  "port": 22,
  "username": "integration",
  "privateKey": "-----BEGIN OPENSSH PRIVATE KEY-----...",
  "passphrase": "optional"
}

The server host key is accepted automatically when no pin is configured. For an installation that requires pinning, add optional hostKeyFingerprint: "SHA256:..." to JSON or ?hostKeyFingerprint=SHA256%3A... to the connection string. Automatic acceptance is stateless: it does not persist a known_hosts record.

Import and export

const imported = await transport.sftpImport('/incoming/daily.csv', {
  namespace: 'agents',
  parentStorageEntryId: agentWorkspaceFolderId,
  name: 'daily.csv',
  contentTypeHint: 'text/csv',
  computeStats: 'sync',
}, 'SFTP_PRODUCTION');

await transport.sftpExport(
  '/outgoing/daily.csv',
  { storageEntryId: imported.entry.storageEntryId, namespace: 'agents' },
  'SFTP_PRODUCTION',
);

sftpImport() streams remote bytes into a direct Storage upload session and returns only after Storage finalizes the entry. sftpExport() reads through a short-lived Storage download URL. Neither direction buffers the complete file in low-code memory. sftpCommands() is for structured SFTP file operations such as listing, stat, rename, and cleanup; it is not a remote shell.

The SFTP integration service reuses healthy connections for the same resolved connection configuration. This is internal pooling, not a caller-owned session: code must remain correct if a later call opens a new connection.

Choose the boundary

Need	Use
External REST/HTTP API, response streaming, SSE or form-data	`api.httpCall()`
Remote SFTP file import/export or structured SFTP operations	`transport.sftp*`
Files, folders, ACL, retention, upload sessions, text/document reads	`storage.*`

There is no transport.http global today. HTTP is already a mature api.httpCall() surface; Transport currently adds the Secret-backed SFTP boundary.

Components

Low-code runtime

Transport

Transport

HTTP

SFTP

One Storage authorization model

HTTP streaming

SFTP

Connection Secret formats

Import and export

Choose the boundary

HTTP

SFTP

​One Storage authorization model

​HTTP streaming

​SFTP

​Connection Secret formats

​Import and export

​Choose the boundary

One Storage authorization model

HTTP streaming

SFTP

Connection Secret formats

Import and export

Choose the boundary