Functions reference

Look up the endpoints, fields, execution modes, and status codes a function exposes.

All function endpoints are app-scoped and nested under an app slug. Lookup is by function slug, which is unique within an app rather than globally.

Interface support#

Start from the task. A checkmark means that interface supports the workflow; an em dash means to choose another interface.

Workflow	JavaScript	Python	REST	Console
Execute a function and wait for the result	✓	✓	✓	✓
Execute a function and return immediately	✓	✓	✓	✓
Read an execution result by task ID	—	✓	✓	✓
List functions in an app	—	✓	✓	✓
Read one function	—	✓	✓	✓
Create a function	—	—	✓	✓
Update a function or its code	—	—	✓	✓
Delete a function	—	—	✓	✓
List version history	—	—	✓	✓
Revert to an earlier version	—	—	✓	✓
List invocations for one function	—	—	✓	✓
List invocations across the site	—	✓	✓	—
Read captured execution logs	—	✓	✓	✓
Define cron schedules	—	—	✓	✓
Filter event-triggered runs	—	—	✓	✓

The JavaScript SDK has one function method, execute. For everything else, use the Python SDK, REST, or Console.

Endpoints#

{app_slug} is the app slug and {slug} is the function slug.

Method	Path	Purpose
`GET`	`/api/apps/{app_slug}/functions/`	List functions in the app
`POST`	`/api/apps/{app_slug}/functions/`	Create a function
`GET`	`/api/apps/{app_slug}/functions/{slug}/`	Read one function
`PATCH`	`/api/apps/{app_slug}/functions/{slug}/`	Update selected fields
`PUT`	`/api/apps/{app_slug}/functions/{slug}/`	Replace the function
`DELETE`	`/api/apps/{app_slug}/functions/{slug}/`	Delete the function
`POST` `GET` `PATCH` `PUT`	`/api/apps/{app_slug}/functions/{slug}/execute/`	Execute the function
`GET`	`/api/apps/{app_slug}/functions/{slug}/history/`	List versions
`POST`	`/api/apps/{app_slug}/functions/{slug}/revert/`	Revert to a version
`GET`	`/api/apps/{app_slug}/functions/{slug}/executions/`	List invocations for this function
`GET`	`/api/apps/{app_slug}/functions/{slug}/executions/{execution_id}/`	Read one invocation, including the executed code
`GET`	`/api/invocations/`	List invocations across the site
`GET`	`/api/invocations/{id}/`	Read one invocation
`GET`	`/api/invocations/{id}/result/`	Read the task result for an invocation
`GET`	`/api/invocations/by-task-id/{task_id}/`	Read an invocation by its task ID (`celery_task_id`)
`GET`	`/api/result/{task_id}/`	Read a task result by its task ID

The execute action accepts four HTTP methods. The verb used reaches the function in params as __method__.

Every endpoint except execute and /api/result/{task_id}/ requires an organization owner or admin, or another cloud user with access to the site. The /api/invocations/ endpoints are scoped to the site, not to an app, and return invocations for every app in the site. /api/result/{task_id}/ is open to any signed-in caller, but only organization users see the traceback of a failed run. See Security and limits.

Function fields#

Writable fields:

name — String, up to 30 characters on create or rename. The source of the generated slug.
execution_mode — app or proxy. Required on create, with no default.
description — Free text.
code — The Python source, for app mode.
webhook_url — A public https:// URL of up to 500 characters. Required for proxy mode.
auth_config — Proxy authentication: bearer, api_key, basic, or custom.
headers — More proxy request headers.
config — Scheduling options such as countdown, a delay in seconds, and expires. Also carries timeout for proxy requests.
params — A JSON Schema describing the expected parameters, or null.
filter_conditions — A CEL expression, evaluated for event triggers only, or null.
is_active — Defaults to true. An inactive function returns 404 from execute and doesn't run for events, but its active schedules keep firing.
async_mode — The default execution style, which a request can override.
is_public — Defaults to false. Allows execution without authentication.
tags — Filterable by name, case-insensitively.
schedules — Cron schedules, written through the function body.

Read-only fields:

slug — Generated from name, made unique in the app with a numeric suffix.
app — Set from the URL.
environment — Always python.
version — Incremented when a versioned field changes.
total_versions — The number of history records.

id, created_at, updated_at, created_by, and modified_by are also read-only.

Fields that create a version#

Changing any of these increments version and writes a history record: name, code, webhook_url, auth_config, headers, config, filter_conditions, execution_mode, is_active, async_mode, description.

A request that changes nothing in that list returns HTTP 200 with a body whose status is error, the message No changes detected, version unchanged, and code BAD_REQUEST. Treat 200 as "request handled", not as "function updated".

Revert restores code and filter_conditions only. Other versioned fields keep their current values, and the version counter advances rather than rewinding.

Execution modes#

Mode	Requires	`data` in a synchronous response	The run's task result
`app`	`app`, `code`	The function's return value	`result`, `stdout`, `stderr`, `logs`, `success`
`proxy`	`app`, `webhook_url`	The webhook's parsed body	`status_code`, `response`, `headers`, `success`

If the return value or webhook body is empty or falsy (None, {}, [], 0, False, or ""), data is the whole task result instead. Return a non-empty object, such as {"items": []}.

Execute request#

{
  "params": {"order_id": 123},
  "async": false
}

Query-string parameters are merged into params, with body values taking precedence on a key collision. When async is omitted, the function's async_mode applies.

A synchronous call returns 200 with the function's return value in data and the invocation record alongside it. An asynchronous call returns 202 with data set to an empty list and an invocation record carrying celery_task_id, which is the handle for later result lookups.

Function signature#

App-mode code must define main taking exactly three parameters:

main.py
def main(params, user_data, sdk_client):
    return {"ok": True}

Validation on write requires the literal text def main(params, user_data, sdk_client): to appear in the code. This is an exact string match, so type annotations, renamed parameters, or different spacing are rejected even when the resulting function would run. At execution time, main must additionally exist, be callable, and accept exactly three parameters.

Parameter	Carries
`params`	The caller's input, merged with query-string values, plus the keys below
`user_data`	The authenticated caller. For an unauthenticated call to a public function, it identifies the platform rather than a person
`sdk_client`	A TaruviBase SDK client that acts as the caller, or as the function's creator for scheduled runs and anonymous calls to a public function. It uses a system token, so it can also read `sensitive` secrets the caller couldn't; don't return secret values to callers

params arrives with three keys added by the platform:

Key	Contents
`__function__`	This function's name, slug, and execution mode
`request`	HTTP metadata for the calling request
`__method__`	The HTTP verb used to call the function

Scheduled and event-triggered runs receive request as {} and no __method__.

Trigger types#

api — The execute endpoint. Filter conditions aren't evaluated, and the function runs as the caller.
schedule — A cron schedule. Filter conditions aren't evaluated, and the function runs as its creator.
event — An event subscription. Filter conditions are evaluated, and a false result skips the run. The function runs as the caller.

Status and error codes#

Status	Code	Cause
200	—	Synchronous execution completed, or a read succeeded
202	—	Asynchronous execution accepted
400	`VALIDATION_ERROR`	Invalid parameters, or code that fails compilation or the signature check
400	`BAD_REQUEST`	Execution failed inside the function, or an update changed nothing
403	`FORBIDDEN`	Authentication required for a non-public function, policy denied execution, or the caller lacks organization access to manage or read functions
404	`NOT_FOUND`	The app, function, or invocation does not exist, or the function is inactive
402	`account_suspended`	The organization's account isn't active
429	`product_suspended`	The Functions usage for this billing period is used up (`module: "functions"`)
503	`gate_unavailable`	Billing status couldn't be read; retry shortly
500	`INTERNAL_ERROR`	A synchronous run exceeded the 900-second wait, or an unexpected failure

The billing refusals come with {detail, code, module} instead of the usual envelope, and both SDKs raise BillingError for them.

Limits#

These are the values in force today. Functions is in preview, so treat them as current behavior rather than fixed guarantees, and avoid depending on an exact number where your code can handle a range.

Limit	Value	How to change it
Synchronous execution wait	900 seconds	—
Automatic retries	None: a failed run isn't retried	—
Proxy request timeout	30 seconds	Set `config.timeout` on the function
Log entries per execution	2,000	—
Log payload per execution	1 MiB	—
Single log message	10,000 characters	—
Functions per list page	20 default, 1,000 maximum	Send `limit` and `offset`
Invocations per list page	20 default, 1,000 maximum	Send `page` and `page_size` to `/api/invocations/`, or `limit` and `offset` to a function's `executions/`

An em dash means the platform sets the value and no request or function setting changes it.

Pace work inside your own code. A function that fans out requests, or one called in a tight loop, is bounded only by what its code does.

Invocation records persist for the life of the function; deleting the function deletes them.

Sandbox imports#

App-mode code may import the modules below and nothing else. An import outside the list is rejected when you save the code, along with other constructs the save-time security scan blocks; see Write a function.

Group	Modules
Standard library	`base64` `bisect` `collections` `copy` `csv` `datetime` `decimal` `functools` `hashlib` `heapq` `io` `itertools` `json` `logging` `math` `random` `re` `statistics` `string` `time` `urllib` `uuid` `warnings` `zipfile`
HTTP clients	`httpx` `requests` `urllib3`
Data and formats	`numpy` `pandas` `tomli` `tomllib` `xml` `yaml`
Dates and times	`dateutil` `pytz`
Text and markup	`bs4` `jinja2` `markdown`
Cryptography and tokens	`cryptography` `jwt`
Validation	`jsonschema` `pydantic`
AI and language models	`anthropic` `cohere` `google` `langchain` `langchain_anthropic` `langchain_cohere` `langchain_community` `langchain_core` `langchain_google_genai` `langchain_openai` `langchain_text_splitters` `langgraph` `langsmith` `openai`
Documents and images	`docling` `docling_core` `fitz` `openpyxl` `pdfplumber` `PIL` `pypdf` `reportlab`
Payments	`stripe`
TaruviBase	`taruvi`

Submodules come with their parent, so import urllib.parse and from google import genai are both permitted.

Database drivers (psycopg2, sqlalchemy), AWS SDKs (boto3, botocore), and traceback are not allowed. Reach your site's data and storage through sdk_client instead.

For what function code can reach once it is running, see Security and limits.