Some docly functions exist only in API scripts

By design By design
Functions that write, send, call out or reveal workspace details are registered only for scripts under #/API/. In a .hash page, a display template or a master page they fail with "is not a function". Reading functions (getFile, getFiles, getJson, linkImage, scaleImage, assetUrl …) work everywhere. The globals query and form and request.Jwt are API-only as well.
Applies to: APIHash templatesJavaScript

What you'll see

Code that works in #/API/save.js is moved into a .hash page and fails with 'saveFile' is not a function, 'httpGet' is not a function or 'setHeader' is not a function. Or a template reads request.Jwt or form and gets nothing.

What's actually happening

A page is rendered once and can be cached and served to the next visitor (see Hash files are cached). Anything with a side effect, or with an answer that depends on who asks, therefore belongs in an API script, and the platform registers those functions only there.

Only in #/API/ scripts and the site router
Writing files and folders: saveFile, patchFile, saveJson, logJson, saveEmbeddedFile, deleteFile, moveFile, renameFile, createFolder, folderExists, moveFolder, renameFolder, deleteFolder, saveFolderProps, saveEmbeddedFolderFile, addTag, removeTag, extractBase64Images, extractAndEmbedBase64Images
Network and mail: httpGet, httpPost, httpPut, httpDelete, httpFormPost, httpFetch, sendEmail, sendForm, smtp.*, pop3.*, imap.*
Shares and publishing: getFileShares, addFileShare, removeFileShare, getFolderShares, addFolderShare, removeFolderShare, allowVisit, allowRead, allowModify, getPublications, getDomains, publishFolder, publishDocument, unpublish
The response and the session: getHeader, setHeader, getCookie, setCookie, setResultCode, setContentDisposition, download, downloadBytes, downloadEmbedded, htmlToPdf, htmlToXlsx, generateDocument, denyAccess, writeJwt, deleteJwt, logOut, getUploads, getUploadBase64, getRemoteIp, flagActivity
Other: counters.*, drive.*, promptAI, getAIModels, getConsoleLog, getProfilePictureUrl, setExecutionTimeout, sleep, unlockFolder

Available everywhere, pages included: the reading functions (getFile, getFiles, getJson, listFiles, getFolder, getFolders, getTags, getEmbeddedFile …), linkImage, linkFile, scaleImage, assetUrl, setMime, redirect, load, loadExcel, markdown and the text helpers.

The request input follows the same split: the globals query and form and the value request.Jwt are set only for API scripts and the router.

The site router runs like an API script and has the same functions, except those that set the status or the body — setResultCode, denyAccess, setContentDisposition and the download functions — and those that read the request body, getUploads and getUploadBase64. The router's result decides the answer, and the body belongs to the page or API script that answers.

What to do