Some docly functions exist only in API scripts

1. What you'll see

   Code that works in #/API/save.js is moved into a .hash page and fails with 'saveFile' is not a function, 'httpGet' is not a function or 'setHeader' is not a function. Or a template reads request.Jwt or form and gets nothing.

2. What's actually happening

   A page is rendered once and can be cached and served to the next visitor (see Hash files are cached). Anything with a side effect, or with an answer that depends on who asks, therefore belongs in an API script, and the platform registers those functions only there.

   Only in #/API/ scripts and the site router
   Writing files and folders: saveFile, patchFile, saveJson, logJson, saveEmbeddedFile, deleteFile, moveFile, renameFile, createFolder, folderExists, moveFolder, renameFolder, deleteFolder, saveFolderProps, saveEmbeddedFolderFile, addTag, removeTag, extractBase64Images, extractAndEmbedBase64Images
   Network and mail: httpGet, httpPost, httpPut, httpDelete, httpFormPost, httpFetch, sendEmail, sendForm, smtp.*, pop3.*, imap.*
   Shares and publishing: getFileShares, addFileShare, removeFileShare, getFolderShares, addFolderShare, removeFolderShare, allowVisit, allowRead, allowModify, getPublications, getDomains, publishFolder, publishDocument, unpublish
   The response and the session: getHeader, setHeader, getCookie, setCookie, setResultCode, setContentDisposition, download, downloadBytes, downloadEmbedded, htmlToPdf, htmlToXlsx, generateDocument, denyAccess, writeJwt, deleteJwt, logOut, getUploads, getUploadBase64, getRemoteIp, flagActivity
   Other: assert, counters.*, drive.*, promptAI, getAIModels, getConsoleLog, getProfilePictureUrl, setExecutionTimeout, sleep, unlockFolder

   Available everywhere, pages included: the reading functions (getFile, getFiles, getJson, listFiles, getFolder, getFolders, getTags, getEmbeddedFile …), linkImage, linkFile, scaleImage, assetUrl, setMime, redirect, load, loadExcel, markdown and the text helpers.

   The request input follows the same split: the globals query and form and the value request.Jwt are set only for API scripts and the router.

   The site router runs like an API script and has the same functions, except those that set the status or the body — setResultCode, denyAccess, setContentDisposition and the download functions — and those that read the request body, getUploads and getUploadBase64. The router's result decides the answer, and the body belongs to the page or API script that answers.

3. What to do

   • Let the page render what is the same for every visitor, and fetch the rest from an API script in the browser.
   • A function that writes must also check the HTTP method; see State-changing API endpoints must require POST.
   • A data-validate function for a form runs as an API script, so it can use these functions.
   • Unsure whether a function is available where you are? Call it from a scratch page; see Use a scratch hash file to test Docly functions.

Last reviewed 20 Oct 2026