OutSystems Professional Developer cheat sheet

Layers: End-User, Core, Foundation, and Library modules - a module may only reference modules in its own layer or the layer directly below it, never upward.

Module types: Reactive Web App, Reactive Web Module, Mobile App, Service Module, Library, Extension, and (legacy) Traditional Web.

Strong references create compile-time dependency and propagate impact analysis; weak references resolve at runtime and are used to break circular dependencies between modules.

Expose Server Actions, Entities, Structures, and Client Variables as Public elements so consumers can reference them; unexposed elements are private to the module.

An Entity is a physical table; a Static Entity is a lookup table with records defined in the model; a Structure is an in-memory composite type with no persistence.

Business logic belongs in Server Actions inside Service or Core modules; screen logic stays thin and delegates to those actions.

A Producer module exposes entities; a Consumer module references them. Set the entity's 'Expose Read Only' flag to prevent writes from consumers.

Multi-tenant modules use the built-in Tenant entity; set 'Is Multi-Tenant' on the module and filter data by TenantId, which the platform applies automatically on exposed entities.

Use Service Studio's 'Find Dependencies' and the Architecture Canvas to detect cycles; cycles require an intermediate module or weak references to resolve.

Screen lifecycle events fire in this order: OnInitialize, OnReady, OnRender (may fire multiple times), OnDestroy.

Screen Actions and Screen Aggregates run on the server; client-side logic lives in Client Actions and JavaScript.

Aggregate output: use 'Max Records' to cap rows, 'Start Index' for paging, and 'Fetch' only when the aggregate is not run automatically (e.g., inside a Client Action).

A Server Action invoked from a Screen Action runs in the same request context, so it can read local variables and session; a Client Action cannot call a Server Action directly - use a Data Action.

Data Actions are server-side actions callable from client-side logic; they accept and return only serializable types (no Entity references, no Binary Data).

Use 'List Append'/'List Concat' on a List variable; a Record List is bound to a Table or List widget and refreshes automatically when its source changes.

Exception handling: 'Exception Handler' flow element catches errors by type; 'All Exceptions' catches the rest. Use 'Log Error' in a Service Center log or the built-in LogMessage action.

Transaction control: set 'Commit' on an entity's Create/Update action to persist immediately; otherwise the platform commits at the end of the request.

Built-in roles: 'Registered' and 'Anonymous'. Screen-level 'Roles' property restricts access before the screen renders.

Mobile Apps use the MABS (Mobile Application Backend Services) runtime; the app is a native shell hosting a JavaScript/Reactive UI, not a WebView-only page.

Offline: mark entities as 'Offline' in the module; the local SQLite database caches them and syncs on connectivity. Entities not marked offline are online-only and require a network call.

Offline sync is incremental and uses the entity's 'Last Modified' timestamp; conflicts resolve last-write-wins unless you implement custom logic.

Mobile screens use 'OnInitialize'/'OnReady'/'OnRender'/'OnDestroy' like web, but 'OnRender' is not guaranteed to fire for off-screen content in lists.

Use 'Network Status' via the built-in 'CheckNetworkStatus' or the 'NetworkStatus' system variable to branch offline/online behavior.

Plugins are compiled native extensions (Cordova/Capacitor wrappers) referenced from a Mobile module; they expose Client Actions.

Screen 'Transition' and 'Layout' properties control navigation animation; use the 'Navigate' client action with a screen reference for programmatic routing.

Mobile apps require a build (Generate App / MABS build) to produce an MAB (Android) or MIP (iOS) package; you cannot run them directly from Service Studio without a device preview.

Reactive Web uses a virtual DOM; UI updates only when bound variables change. Avoid direct DOM manipulation - use built-in widgets and OutSystems UI patterns.

Block widgets are reusable UI components with input parameters, events, and placeholders; they encapsulate markup and CSS.

CSS: use the 'Style Sheet' editor on a screen or the theme; styles cascade from Theme > Layout > Screen > Block. Inline 'Style' attribute on a widget has highest specificity.

OutSystems UI framework provides patterns (e.g., Card, List, Tabs, Carousel) and utility classes; use them before writing custom CSS.

Client Variables persist in browser storage and are accessible across screens; Local Variables are scoped to a single screen/action.

Use 'Ajax Refresh' to re-run an aggregate and refresh a widget without a full page reload; 'Refresh Data' re-runs the screen's data sources.

The 'If' widget conditionally renders content; 'Switch' selects among multiple content blocks. Use 'For Each' to iterate lists in markup.

Accessibility: set 'Extended Description' (aria-label) on icon-only buttons, use semantic heading levels, and ensure color contrast meets WCAG 2.1 AA.

JavaScript: add via the 'JavaScript' property on a screen or a Script widget; use 'RequireScript' to load external libraries on demand.

Authentication: built-in 'Users' entity stores credentials; external providers (Azure AD, SAML, LDAP) are configured in Service Center under 'Authentication'.

Authorization is role-based: assign roles to users via the 'User' entity's 'Roles' or the 'CheckRole' built-in function; screen and action 'Roles' properties enforce access.

'CheckRole' system actions (e.g., CheckUserRole) are auto-generated for each entity to enforce CRUD permissions.

SQL injection: OutSystems parameterizes aggregates and SQL widgets automatically; never concatenate user input into the 'SQL' property of an SQL widget.

XSS: the platform HTML-encodes output by default; use 'EncodeJavaScript' or 'SanitizeHtml' when injecting into scripts or rich text.

CSRF: Reactive Web screens include an anti-CSRF token automatically; custom AJAX endpoints must validate it.

Sensitive data: mark entity attributes as 'Sensitive' to encrypt at rest; use 'Site Properties' for secrets rather than hardcoding.

Session: configure 'Session Timeout' in Service Center; use 'InvalidateSession' on logout. HTTPS is enforced via the 'HTTPS' setting on the environment.

Audit: enable 'Audit' on entities to log create/update/delete with user and timestamp; view logs in Service Center > Monitoring.