OutSystems Professional DevOps Engineer cheat sheet

OutSystems CI/CD is built on LifeTime APIs and the OutSystems CLI (OSCLI); pipelines automate validate, publish, and deploy steps across environments.

A deployment plan in LifeTime defines the ordered environments a solution traverses; each plan step references a source environment and a target environment.

Application lifecycle stages: Development, Quality/Test, Pre-Production, Production. Only Production is typically protected by a deployment plan with manual approval gates.

OSCLI commands used in pipelines include oscli deploy, oscli publish, oscli create-app, and oscli list; authenticate with a personal or service-account token per environment.

LifeTime exposes a REST API (/lifetimeapi/rest/v2/) for deployments, applications, modules, and environment health; use it when OSCLI is not scriptable in your CI tool.

A solution version is incremented at deployment time; the version label is stored in the target environment and can be queried via API for traceability.

Application-level impact analysis must be run before publishing a module: OutSystems marks dependent modules as needing republish.

Automated tests run in the Quality environment via BDD/BDD framework (SpecFlow/Gherkin) and are executed as part of the pipeline, not in Production.

Environments are registered in LifeTime by their OutSystems deployment controller address; each environment has a unique role (Development, Test, Production, etc.).

An environment is a set of front-end servers, a deployment controller, a database server, and a session database; scaling adds front-ends behind the load balancer.

Deployment is asynchronous: LifeTime queues a deployment, the controller pushes the module to target front-ends, and the target returns a status (success, failed, needs-republish).

Solution dependencies must be deployed together or already present in the target; missing dependencies cause deployment failure with a dependency error.

Database schema changes are managed by OutSystems entity model; destructive changes (drop column, type change) require a manual confirmation or a new entity.

Environment health checks include: deployment controller connectivity, database connectivity, session database, and license status; failures block deployments.

Rollback is not automatic: to revert, redeploy the previous solution version from the source environment; the platform keeps prior module versions in the target.

Service Center shows per-module version history and the deployed timestamp; use it to confirm which build is live in an environment.

Service Center > Monitoring shows real-time and historical performance counters: requests per minute, average response time, errors, and exceptions.

Log messages are categorized as Error, Warning, Info, and Debug; Debug logging must be enabled per module in Service Center and disabled after troubleshooting.

Integration logs record consumed and exposed SOAP/REST calls with request/response payloads; retention is configurable per environment.

The LogMessage action writes custom entries to the platform log; use it with severity and module context for traceable diagnostics.

Performance troubleshooting: use Service Center screens (Slowest Web Screens, Slowest Queries, Top Exceptions) to identify bottlenecks before code review.

Native OutSystems logs are stored in the platform database; external log shipping (e.g., to SIEM) requires custom integration or platform extensions.

Health Monitor alerts on environment-level conditions (high error rate, DB connection issues); thresholds are configured per environment.

Exception handling: unhandled exceptions surface in Service Center > Errors with a stack trace; ExceptionHandler in a flow logs and recovers gracefully.

Role-based access: LifeTime roles (Administrator, Developer, Tester, Operations) control deployment permissions; Service Center roles control per-environment actions.

IT User authentication in LifeTime and Service Center can use OutSystems built-in, Active Directory/LDAP, or SAML 2.0/OpenID Connect federation.

End-user authentication in applications uses the Users application, external IdP (SAML/OIDC), or custom authentication; sessions are managed by the platform session database.

Security scanning: use the OutSystems platform's built-in security checks and external SAST/DAST tools; secrets in Site Properties must not be committed to source control.

Licensing: OutSystems licenses are per-environment; Production typically requires a full license while non-production uses development or test licenses.

Audit trail: LifeTime records who deployed what and when; Service Center logs configuration changes and user administration actions.

Platform operations include periodic backups of the platform and application databases, certificate renewal for HTTPS endpoints, and patching of the platform server.

Governance: enforce naming conventions for modules and solutions, restrict who can publish to Production, and require impact analysis plus approval before deployment.