Runtime API

Use the smallest namespace that fits the operation. Platform state and external I/O belong to api or storage; pure transformation belongs to util; reusable domain behavior is addressed through lib.LibraryName.ElementKey.member. Use lib for new shared-library calls. The older libs alias is deprecated and is marked accordingly in editor hints. Existing calls and exported type references remain supported; the alias resolves to the same library members. Libraries use named exports in JS and TS. The permanent @default element exposes lib.LibraryName.member, with lib.LibraryName['@default'].member as the same binding. Unexported declarations stay local to their element. @default export names cannot match any element key, including exported types. Use named export declarations or local named export clauses; ES default exports, module imports, external re-exports and source CommonJS exports are unsupported.

Use the generated Low-code runtime reference when you need an exact signature or editor-provided example. It is organized by api, storage, agent, and util, and is synchronized from the declaration source that feeds Monaco.

Context and control

const input = api.input();
const executionId = api.getExecutionId();
const operationId = api.getOperationId();

if (!input?.customerId) {
  api.throw(400, { message: 'customerId is required' });
}

api.log({ message: 'Started', args: { executionId, operationId } });

Use api.getExecutionId() to correlate the current execution with traces, logs, and operations history.

Nested execution

const result = await api.executeComponent({
  componentId: api.input('componentId'),
  inputs: { customerId: api.input('customerId') },
});

return result;

Nested calls create a fresh isolated execution on the current host by default, with independent execution state and an Execution ID. They share the caller’s host capacity. Use options: { executionHost: 'remote' } when the child must run through the separate Sandbox host. Calls inherit the caller’s remaining deadline and nesting is limited to five levels. A local child also receives the caller’s cancellation signal. Remote calls require at least one second of remaining time. Use a library when you only need shared business logic within the current execution.

Utilities

const id = util.randomUUID();
const encoded = util.encodeBase64(JSON.stringify(api.input()));
const digest = util.sha256(encoded);

return { id, encoded, digest };

RSA encrypt/decrypt/sign/verify, AES, password hashing, validation and sleep return Promises. Await their results, including deprecated api.* aliases. SHA-1/SHA-256/MD5, HMAC sign/verify, randomBytes, randomInt and timing-safe comparisons return values synchronously. They do not require await.

Helper	Argument limit
SHA-1/SHA-256/MD5	Payload up to 5 MiB of UTF-8 text
HMAC sign/verify	Payload up to 5 MiB; secret and signature up to 64 KiB each
Timing-safe comparison	Each input up to 64 KiB
`randomBytes`	Integer size 0..65536 bytes before hex/base64 encoding
`randomString` / `otp`	Integer length 0..65536; alphabet 1..65536 UTF-16 code units
`randomInt`	Inclusive safe-integer bounds; `max + 1` must be safe; range size below 2^48

String byte limits use UTF-8. Invalid types/options throw TypeError; size/range violations throw RangeError. Unsupported extra arguments are rejected for these bounded helpers. Limits apply to individual calls; they do not guarantee a total CPU or memory budget for the Component. UUID, JWT and base64 helpers also remain synchronous. Asynchronous crypto can reduce time spent blocking request processing; it does not limit CPU consumption. Key import and data conversion still have a cost, especially for encrypted private keys or large payloads.

Agents

The agent namespace exposes Agent, run, inbox, plugin, and Assistant-thread operations to approved runtime code. Exact operations and authorization are shown in the generated editor declarations and Platform API reference.

A runtime method appearing in editor types does not bypass role, instance, approval, or policy enforcement. Treat generated types as a callable contract, not a permission grant.

The technical key @default is available only in JS/TS libraries. Ordinary DEFAULT nodes keep their existing qualified paths and order. TypeScript type names use the short namespace; the bracket alias exposes runtime values. Primitive exports are captured at initialization; expose functions for mutable state. Every JS/TS library includes a permanent @default, initially a documentation comment only. The API rejects renaming, deleting or replacing it. Node order affects editor sorting; proxy dependency resolution does not require an earlier node. See Libraries for complete authoring and consumption examples.

Build applications

Low-code runtime

Low-code reference

Context and control

Nested execution

Utilities

Agents

​Context and control

​Nested execution

​Utilities

​Agents

Context and control

Nested execution

Utilities

Agents