Action schema — UI Protocol property reference

Action schemas of the ObjectStack UI Protocol: Action, ActionAi, ActionLocation and 3 more — each property with its type, default and a TypeScript example.

Source: packages/spec/src/ui/action.zod.ts

TypeScript Usage

import { ActionSchema, ActionAiSchema, ActionLocationSchema, ActionParamSchema, ActionType, InlineActionSchema } from '@objectstack/spec/ui';
import type { Action, ActionAi, ActionLocation, ActionParam, ActionType, InlineAction } from '@objectstack/spec/ui';

// Validate data
const result = ActionSchema.parse(data);

Action

Properties

Property	Type	Required	Description
name	`string`	✅	Machine name (lowercase snake_case)
label	`string \| Record<string, string>`	✅	Display label
description	`string \| Record<string, string>`	optional	Explanatory line shown under the title in the action's param dialog. Carries the confirm question for an action that collects params (one dialog, not two). Not the LLM-facing `ai.description`.
objectName	`string`	optional	Target object this action belongs to. When set, the action is auto-merged into the object's actions array by defineStack().
icon	`string`	optional	Icon name
locations	`Enum<'list_toolbar' \| 'list_item' \| 'record_header' \| 'record_more' \| 'record_related' \| 'record_section'>[]`	optional	Locations where this action is visible
component	`Enum<'action:button' \| 'action:icon' \| 'action:menu' \| 'action:group'>`	optional	Visual component override
type	`Enum<'script' \| 'url' \| 'modal' \| 'flow' \| 'api' \| 'form'>`	optional (default: `"script"`)	Action functionality type — the dispatch route. The declarative single-record field write is not a type: it is `operation: 'update'` + `patch` on the default `script` route.
target	`string`	optional	URL, Script Name, Flow ID, or API Endpoint. Supports $`{param.X}` and $`{ctx.X}` interpolation. For type:'url': an http:// or https:// URL, a mailto: address, or an in-app path starting with / or ./ — every other scheme and a protocol-relative //host are refused.
openIn	`Enum<'self' \| 'new-tab'>`	optional	For type:'url' — where to open `target`. 'new-tab' opens a new browser tab; 'self' navigates in place. When omitted, external/absolute URLs open in a new tab and relative URLs navigate in place. Static execution option — keep it OUT of `params` (which is user-input-collection only).
body	`{ language: 'expression'; source: string } \| { language: 'js'; source: string; capabilities?: Enum<'api.read' \| 'api.write' \| 'api.transaction' \| 'crypto.uuid' \| 'log'>[]; timeoutMs?: integer; … }`	optional	Action body — expression (L1) or sandboxed JS (L2). Only used when type is `script`.
operation	`Enum<'update'>`	optional	The declarative single-record field write, mirroring a list view's `bulkActionDefs`: `'update'` applies `patch` (merged under the collected `params`) to the current record on the data plane AS THE CALLER — never system-elevated — so the caller's permissions, the object's hooks and its validations fire as for a user edit. `type` stays at its default `'script'` (the platform action route the write is performed on); `target`/`body`/`method`/`bodyExtra` are refused beside it. `'delete'` and `'custom'` have no row-level form.
patch	`Record<string, any>`	optional	For `operation: 'update'` — static field values written to the current record, merged UNDER the user-supplied `params` so a fixed value can be declared without exposing it in the dialog. Written on the data plane as the caller: object permissions, hooks and validations fire as for a user edit. Refused on an action without `operation: 'update'` (it would be silently dropped).
execution	`Enum<'perRecord' \| 'aggregate'>`	optional	The bulk dispatch contract this action's BODY is written for, in `bulkActionDefs`' own vocabulary: 'perRecord' = one dispatch per selected row carrying that row's `recordId` (the view's `bulkActions: ['<name>']` bare-string form); 'aggregate' = ONE dispatch for the whole selection carrying every id in `params._selectedIds` (a `bulkActionDefs` entry with `execution: 'aggregate'`). Optional with NO default — omit it only when the body genuinely serves both. A list view wiring a declared action under the other contract is refused by `@objectstack/lint` (`action-dispatch-contract-mismatch`).
execute	`never`	optional	[REMOVED] `execute` was removed in @objectstack/spec 17 — use `target`. Rename the key; the value (a handler / flow / URL ref) is unchanged. Run `os migrate meta --from 16` to list the mechanical edits for existing sources; `--write` applies the ones it can prove, and you apply the rest by hand.
params	`{ name?: string; field?: string; objectOverride?: string; label?: string \| Record<string, string>; … }[]`	optional	Input parameters required from user — an ActionParam[] DEFINITION array, never a payload map (a static request body goes in `bodyExtra`).
variant	`Enum<'primary' \| 'secondary' \| 'danger' \| 'ghost' \| 'link'>`	optional	Button visual variant for styling (primary = highlighted, danger = destructive, ghost = transparent)
order	`number`	optional	Sort order within a location group (lower = higher). Promotes/demotes an action toward the record_header primary button; stable, so actions without `order` keep their registration order.
confirmText	`string \| Record<string, string>`	optional	Confirmation message before execution. On a registered action, pairing this with a non-empty `params` is refused — that opens a second dialog for one decision; put the question on `description` instead. Correct on a param-LESS action, where the confirm is the only dialog there is.
successMessage	`string \| Record<string, string>`	optional	Success message shown after the action succeeds. On a `type: 'api'` or `type: 'script'` action it may interpolate $`{result.*}` — the server response payload, the same scope `onSuccess.navigate` declares (e.g. $`{result.id}`). On a registered action that declares `outcomeMessages`, the entry named by the response's `outcome` is shown instead, and this message is the fallback.
outcomeMessages	`Record<string, string \| Record<string, string>>`	optional	Success copy per handler outcome, for type:'api' and type:'script' actions: keys are the snake_case `outcome` values the handler returns in its success payload (e.g. archived, already_archived), values the message shown for that outcome. Each message may interpolate $`{result.*}`, the scope `onSuccess.navigate` declares. An outcome with no entry here falls back to `successMessage`, then to the default text. Not allowed beside `resultDialog` (which suppresses the success toast) or `operation: 'update'` (no handler, so no outcome).
errorMessage	`string \| Record<string, string>`	optional	Error message to show when the action fails (overrides the raw error).
refreshAfter	`boolean`	optional (default: `false`)	Refresh view after execution
undoable	`boolean`	optional	Offer an Undo affordance after this single-record update action succeeds. `operation: 'update'` is the one declared operation and the declared form of that action: what the undo captures is the prior value of EVERY field the action writes — the merged write bag, `patch` UNDER the collected `params`, not `patch` alone. An action with no `operation` declares no write set here, but `type: 'api'` is fulfilled by the console, which builds the undo envelope from `undoable` alone. Those two shapes — `operation: 'update'` and `type: 'api'` — are the whole fulfillable set; on a registered action `undoable` beside any other shape is refused, because nothing would anchor the capture.
resultDialog	`{ title?: string \| Record<string, string>; description?: string \| Record<string, string>; acknowledge?: string \| Record<string, string>; format?: Enum<'qrcode' \| 'code-list' \| 'secret' \| 'text' \| 'json'>; … }`	optional	Render API response in a one-shot reveal dialog (suppresses successMessage when set).
visible	`boolean \| string \| { dialect: Enum<'cel' \| 'cron' \| 'template'>; source: string; ast?: any; meta?: object }`	optional	Visibility predicate — `true`/`false` literal, CEL string, or `{dialect, source}` envelope. The action is offered when it evaluates TRUE. Omit = always visible.
requiresFeature	`Enum<'twoFactor' \| 'organization' \| 'multiOrgEnabled' \| 'degradedTenancy' \| 'oidcProvider' \| 'sso' \| 'ssoEnforced' \| 'deviceAuthorization' \| 'admin' \| 'phoneNumber' \| 'phoneNumberOtp'>`	optional	Public auth feature flag gating this action; lowered into `visible` at parse time.
requiresMembershipReach	`Enum<'invite_member' \| 'cancel_invitation' \| 'update_member_role' \| 'transfer_ownership' \| 'remove_member' \| 'create_team' \| 'update_team' \| 'remove_team' \| … +2 more>`	optional	Organization endpoint (a MEMBERSHIP_REACH row) whose membership-grade gate this action follows; lowered into `visible` over current_user.positions at parse time.
disabled	`boolean \| string \| { dialect: Enum<'cel' \| 'cron' \| 'template'>; source: string; ast?: any; meta?: object }`	optional	Disabled predicate — `true`/`false` literal, CEL string, or `{dialect, source}` envelope. The action is shown but refused when it evaluates TRUE. Omit = never disabled.
requiredPermissions	`string[]`	optional	[ADR-0066 D4] Capabilities required to invoke this action. Enforced with 403 on the platform action route (script/flow/modal + MCP) and mirrored as a UI hide; a `type: api` action pointed at a custom endpoint must re-check it there.
shortcut	`never`	optional	[REMOVED] `action.shortcut` was removed in @objectstack/spec 17.0.0 (audit close-out) — it never triggered anything: no keydown listener feeds ActionEngine.getShortcuts(), and objectui's keyboard stack (useKeyboardShortcuts) is hand-registered and never consults action metadata. Delete the key. For a real shortcut, register the key in the Console keyboard stack and have its handler invoke the action by name. Run `os migrate meta --from 16` to list the mechanical edits for existing sources; `--write` applies the ones it can prove, and you apply the rest by hand.
bulkEnabled	`never`	optional	[REMOVED] `action.bulkEnabled` was removed in @objectstack/spec 17.0.0 (audit close-out) — the multi-select toolbar is driven by the LIST VIEW's `bulkActions` / `bulkActionDefs`, never by this flag, so setting it changed nothing. Delete the key and declare the action in the view's `bulkActions` instead. Run `os migrate meta --from 16` to list the mechanical edits for existing sources; `--write` applies the ones it can prove, and you apply the rest by hand.
ai	`{ exposed?: boolean; description?: string; category?: Enum<'data' \| 'action' \| 'flow' \| 'integration' \| 'vector_search' \| 'analytics' \| 'utility'>; paramHints?: Record<string, object>; … }`	optional	AI exposure (opt-in). Set ai.exposed=true + ai.description to make this callable by agents.
recordIdParam	`string`	optional	Body key to inject the row id into when running from a list_item context.
recordIdField	`string`	optional	Row field whose value seeds recordIdParam. Defaults to "id".
bodyShape	`'flat' \| { wrap: string }`	optional	Body wrapping: flat (default) or `{ wrap: key }` to nest user-collected params under a key.
method	`Enum<'POST' \| 'PATCH' \| 'PUT' \| 'DELETE'>`	optional	HTTP method for type:"api" actions. Defaults to POST.
bodyExtra	`Record<string, any>`	optional	Static request-body fields for a type:"api" action, merged last (overrides user params). `{{page.<var>}}` tokens are resolved by the runtime. This — not `params` — is where a payload goes.
mode	`Enum<'create' \| 'edit' \| 'delete' \| 'custom'>`	optional	Semantic mode of the action.
opensInNewTab	`boolean`	optional	Open the action result in a new tab. The renderer pre-opens the tab synchronously on click (popup-blocker-safe) and navigates it to the handler's redirectUrl.
newTabUrl	`string`	optional	Direct new-tab URL template (`{recordId}` placeholder). When set with opensInNewTab, the renderer navigates the pre-opened tab here immediately — no action POST. The endpoint must enforce auth itself.
onSuccess	`{ navigate: string; openIn?: Enum<'self' \| 'newTab'> }`	optional	Post-success navigation for type:'api' and type:'script' actions. `navigate` is a route/URL template interpolating $`{param.}`, $`{ctx.}` and $`{result.*}` (the server response); `openIn` defaults 'self'. The handler-return convention (`{ redirectUrl }` without openIn) keeps its 17.0.0 new-tab behavior.
aria	`never`	optional	[REMOVED] `action.aria` was removed in @objectstack/spec 17.5.0 (ADR-0049 enforce-or-remove) — no action surface ever applied it: the button, icon, menu, group and bar renderers, the row and bulk action menus and the record quick-actions toolbar all take the accessible name from the action's `label` and never read this block, so ARIA attributes declared here parsed and then silently did not reach the DOM. Delete the key. The accessible name that IS applied is the action's required `label` — the visible button or menu-item text, and the `aria-label` of an icon-only action — so write the name you meant there. To name the region that PLACES the actions, author `ariaLabel` / `ariaDescribedBy` / `role` in the `aria` block of the placing node: `page.components[].aria` (the component that renders the actions) or the list view `aria`. Run `os migrate meta --from 17` to list the mechanical edits for existing sources; `--write` applies the ones it can prove, and you apply the rest by hand.
_lock	`Enum<'none' \| 'no-overlay' \| 'no-delete' \| 'full'>`	optional	Item-level lock — controls overlay & delete (ADR-0010).
_lockReason	`string`	optional	Human-readable reason shown when a write is refused by _lock.
_lockSource	`Enum<'artifact' \| 'package' \| 'env-forced'>`	optional	Layer that set _lock (artifact \| package \| env-forced).
_provenance	`Enum<'package' \| 'org' \| 'env-forced'>`	optional	Origin of the item (package \| org \| env-forced).
_packageId	`string`	optional	Owning package machine id.
_packageVersion	`string`	optional	Owning package version.
_lockDocsUrl	`string`	optional	Optional documentation link surfaced next to _lockReason.

Allowed Values: `Action.requiresMembershipReach`

invite_member
cancel_invitation
update_member_role
transfer_ownership
remove_member
create_team
update_team
remove_team
add_team_member
remove_team_member

Nested Shape: `Action.body[language='expression']`

L1 expression body — pure formula, no IO

Property	Type	Required	Description
language	`'expression'`	✅
source	`string`	✅	Formula expression source

Nested Shape: `Action.body[language='js']`

L2 sandboxed JS body — runs inside an isolated VM with declared capabilities

Property	Type	Required	Description
language	`'js'`	✅
source	`string`	✅	Function body source
capabilities	`Enum<'api.read' \| 'api.write' \| 'api.transaction' \| 'crypto.uuid' \| 'log'>[]`	optional (default: `[]`)	Granted capability tokens
timeoutMs	`integer`	optional	Per-invocation timeout (ms)
memoryMb	`integer`	optional	Per-invocation memory cap (MB)

Nested Shape: `Action.params[number]`

Property	Type	Required	Description
name	`string`	optional
field	`string`	optional	Snake case identifier (lowercase with underscores only)
objectOverride	`string`	optional	Snake case identifier (lowercase with underscores only)
label	`string \| Record<string, string>`	optional	Display label — the default-language string, or an inline locale map (`{ en, "zh-CN" }`) resolved at render time
type	`Enum<'text' \| 'textarea' \| 'email' \| 'url' \| 'phone' \| 'password' \| 'secret' \| …>`	optional
required	`boolean`	optional (default: `false`)
options	`{ label: string \| Record<string, string>; value: string; visibleWhen?: string \| object }[]`	optional
placeholder	`string`	optional
helpText	`string`	optional
defaultValue	`any`	optional
multiple	`boolean`	optional	Allow multiple values (array value shape); mirrors FieldSchema.multiple.
accept	`string[]`	optional	Accepted upload types (MIME types / extensions) for file/image params.
maxSize	`integer`	optional	Max upload size in bytes for file/image params.
reference	`string`	optional	Reference target object for inline lookup/master_detail params; mirrors FieldSchema.reference.
defaultFromRow	`boolean`	optional
carryOver	`boolean`	optional	Carry-over param: seed the value from the current row (requires defaultFromRow: true), render it as a non-editable summary in the dialog, and submit it verbatim in the request body. Unlike `visible: false` (which omits the param from the submission entirely), a carry-over param is always sent.
visible	`string \| { dialect: Enum<'cel' \| 'cron' \| 'template'>; source: string; ast?: any; meta?: object }`	optional	Param visibility predicate (CEL); omits the param when false.
requiresFeature	`Enum<'twoFactor' \| 'organization' \| 'multiOrgEnabled' \| 'degradedTenancy' \| …>`	optional	Public auth feature flag gating this param; lowered into `visible` at parse time.

Nested Shape: `Action.resultDialog`

Property	Type	Required	Description
title	`string \| Record<string, string>`	optional	Display label — the default-language string, or an inline locale map (`{ en, "zh-CN" }`) resolved at render time
description	`string \| Record<string, string>`	optional	Display label — the default-language string, or an inline locale map (`{ en, "zh-CN" }`) resolved at render time
acknowledge	`string \| Record<string, string>`	optional	Acknowledge button label, e.g. "I have saved this"
format	`Enum<'qrcode' \| 'code-list' \| 'secret' \| 'text' \| 'json'>`	optional	Default format for fields without their own format. Defaults to json when omitted.
fields	`{ path: string; label?: string \| Record<string, string>; format?: Enum<'qrcode' \| 'code-list' \| 'secret' \| 'text' \| 'json'> }[]`	optional	Which fields from result.data to render. Omit to dump full JSON.

Nested Shape: `Action.ai`

Property	Type	Required	Description
exposed	`boolean`	optional (default: `false`)	Expose this action to AI agents. Requires `description` when true.
description	`string`	optional	LLM-facing description (≥40 chars). Required when exposed.
category	`Enum<'data' \| 'action' \| 'flow' \| 'integration' \| 'vector_search' \| 'analytics' \| 'utility'>`	optional	Tool category override (defaults to "action").
paramHints	`Record<string, { description?: string; enum?: (string \| number)[]; examples?: any[] }>`	optional	Per-parameter AI hints keyed by param name.
outputSchema	`Record<string, any>`	optional	JSON Schema for the action return value. An untyped subschema that carries a type-scoped keyword (properties, items, pattern, minimum, …) is refused at its path, because the AI runtime's schema reader does not check it; declare its "type".
requiresConfirmation	`boolean`	optional	Override HITL confirmation for AI invocations.

Nested Shape: `Action.onSuccess`

Property	Type	Required	Description
navigate	`string`	✅	Route/URL template navigated to after the action succeeds. Interpolates $`{param.}` (params-dialog values), $`{ctx.}` (origin/apiBase/user/org/recordId/selection) and $`{result.*}` (the action's server response payload — NEW with this key, e.g. $`{result.id}`). An http:// or https:// URL, a mailto: address, or an in-app path starting with / or ./ (an SPA route hop); a template that opens with ${ is judged after interpolation. Every other scheme and a protocol-relative //host are refused. Renderers MUST encodeURIComponent values in query positions.
openIn	`Enum<'self' \| 'newTab'>`	optional (default: `"self"`)	Where to perform the post-success navigation: 'self' (default — in-place SPA navigation, immune to popup blocking) or 'newTab'. Closed enum — no general navigation DSL.

ActionAi

Properties

Property	Type	Required	Description
exposed	`boolean`	optional (default: `false`)	Expose this action to AI agents. Requires `description` when true.
description	`string`	optional	LLM-facing description (≥40 chars). Required when exposed.
category	`Enum<'data' \| 'action' \| 'flow' \| 'integration' \| 'vector_search' \| 'analytics' \| 'utility'>`	optional	Tool category override (defaults to "action").
paramHints	`Record<string, { description?: string; enum?: (string \| number)[]; examples?: any[] }>`	optional	Per-parameter AI hints keyed by param name.
outputSchema	`Record<string, any>`	optional	JSON Schema for the action return value. An untyped subschema that carries a type-scoped keyword (properties, items, pattern, minimum, …) is refused at its path, because the AI runtime's schema reader does not check it; declare its "type".
requiresConfirmation	`boolean`	optional	Override HITL confirmation for AI invocations.

ActionLocation

Allowed Values

list_toolbar
list_item
record_header
record_more
record_related
record_section

ActionParam

Properties

Property	Type	Required	Description
name	`string`	optional
field	`string`	optional	Snake case identifier (lowercase with underscores only)
objectOverride	`string`	optional	Snake case identifier (lowercase with underscores only)
label	`string \| Record<string, string>`	optional	Display label — the default-language string, or an inline locale map (`{ en, "zh-CN" }`) resolved at render time
type	`Enum<'text' \| 'textarea' \| 'email' \| 'url' \| 'phone' \| 'password' \| 'secret' \| 'markdown' \| 'html' \| 'richtext' \| 'number' \| 'currency' \| 'percent' \| 'date' \| … +35 more>`	optional
required	`boolean`	optional (default: `false`)
options	`{ label: string \| Record<string, string>; value: string; visibleWhen?: string \| object }[]`	optional
placeholder	`string`	optional
helpText	`string`	optional
defaultValue	`any`	optional
multiple	`boolean`	optional	Allow multiple values (array value shape); mirrors FieldSchema.multiple.
accept	`string[]`	optional	Accepted upload types (MIME types / extensions) for file/image params.
maxSize	`integer`	optional	Max upload size in bytes for file/image params.
reference	`string`	optional	Reference target object for inline lookup/master_detail params; mirrors FieldSchema.reference.
defaultFromRow	`boolean`	optional
carryOver	`boolean`	optional	Carry-over param: seed the value from the current row (requires defaultFromRow: true), render it as a non-editable summary in the dialog, and submit it verbatim in the request body. Unlike `visible: false` (which omits the param from the submission entirely), a carry-over param is always sent.
visible	`string \| { dialect: Enum<'cel' \| 'cron' \| 'template'>; source: string; ast?: any; meta?: object }`	optional	Param visibility predicate (CEL); omits the param when false.
requiresFeature	`Enum<'twoFactor' \| 'organization' \| 'multiOrgEnabled' \| 'degradedTenancy' \| 'oidcProvider' \| 'sso' \| 'ssoEnforced' \| 'deviceAuthorization' \| 'admin' \| 'phoneNumber' \| 'phoneNumberOtp'>`	optional	Public auth feature flag gating this param; lowered into `visible` at parse time.

Allowed Values: `ActionParam.type`

text
textarea
email
url
phone
password
secret
markdown
html
richtext
number
currency
percent
date
datetime
time
boolean
toggle
select
multiselect
radio
checkboxes
lookup
master_detail
tree
user
image
file
avatar
video
audio
formula
summary
autonumber
composite
repeater
record
location
address
code
json
color
rating
slider
signature
qrcode
progress
tags
vector

Nested Shape: `ActionParam.options[number]`

Property	Type	Required	Description
label	`string \| Record<string, string>`	✅	Display label — the default-language string, or an inline locale map (`{ en, "zh-CN" }`) resolved at render time
value	`string`	✅
visibleWhen	`string \| { dialect: Enum<'cel' \| 'cron' \| 'template'>; source: string; ast?: any; meta?: object }`	optional	Per-option visibility predicate (CEL) — option is offered only when TRUE (else omitted). Same env as the field-level per-option visibleWhen (record + current_user). e.g. P`record.tier == 'gold'`

ActionType

Allowed Values

script
url
modal
flow
api
form

InlineAction

Properties

Property	Type	Required	Description
type	`Enum<'script' \| 'url' \| 'modal' \| 'flow' \| 'api' \| 'form'>`	optional (default: `"script"`)	Action functionality type — the dispatch route. The declarative single-record field write is not a type: it is `operation: 'update'` + `patch` on the default `script` route.
name	`string`	optional	Machine name (lowercase snake_case)
label	`string \| Record<string, string>`	optional	Display label
target	`string`	optional	URL, Script Name, Flow ID, or API Endpoint. Supports $`{param.X}` and $`{ctx.X}` interpolation. For type:'url': an http:// or https:// URL, a mailto: address, or an in-app path starting with / or ./ — every other scheme and a protocol-relative //host are refused.
openIn	`Enum<'self' \| 'new-tab'>`	optional	For type:'url' — where to open `target`. 'new-tab' opens a new browser tab; 'self' navigates in place. When omitted, external/absolute URLs open in a new tab and relative URLs navigate in place. Static execution option — keep it OUT of `params` (which is user-input-collection only).
method	`Enum<'POST' \| 'PATCH' \| 'PUT' \| 'DELETE'>`	optional	HTTP method for type:"api" actions. Defaults to POST.
params	`{ name?: string; field?: string; objectOverride?: string; label?: string \| Record<string, string>; … }[]`	optional	Input parameters required from user — an ActionParam[] DEFINITION array, never a payload map (a static request body goes in `bodyExtra`).
bodyExtra	`Record<string, any>`	optional	Static request-body fields for a type:"api" action, merged last (overrides user params). `{{page.<var>}}` tokens are resolved by the runtime. This — not `params` — is where a payload goes.
confirmText	`string \| Record<string, string>`	optional	Confirmation message before execution. On a registered action, pairing this with a non-empty `params` is refused — that opens a second dialog for one decision; put the question on `description` instead. Correct on a param-LESS action, where the confirm is the only dialog there is.
successMessage	`string \| Record<string, string>`	optional	Success message shown after the action succeeds. On a `type: 'api'` or `type: 'script'` action it may interpolate $`{result.*}` — the server response payload, the same scope `onSuccess.navigate` declares (e.g. $`{result.id}`). On a registered action that declares `outcomeMessages`, the entry named by the response's `outcome` is shown instead, and this message is the fallback.
errorMessage	`string \| Record<string, string>`	optional	Error message to show when the action fails (overrides the raw error).
refreshAfter	`boolean`	optional (default: `false`)	Refresh view after execution
opensInNewTab	`boolean`	optional	Open the action result in a new tab. The renderer pre-opens the tab synchronously on click (popup-blocker-safe) and navigates it to the handler's redirectUrl.

Nested Shape: `InlineAction.params[number]`

Property	Type	Required	Description
name	`string`	optional
field	`string`	optional	Snake case identifier (lowercase with underscores only)
objectOverride	`string`	optional	Snake case identifier (lowercase with underscores only)
label	`string \| Record<string, string>`	optional	Display label — the default-language string, or an inline locale map (`{ en, "zh-CN" }`) resolved at render time
type	`Enum<'text' \| 'textarea' \| 'email' \| 'url' \| 'phone' \| 'password' \| 'secret' \| …>`	optional
required	`boolean`	optional (default: `false`)
options	`{ label: string \| Record<string, string>; value: string; visibleWhen?: string \| object }[]`	optional
placeholder	`string`	optional
helpText	`string`	optional
defaultValue	`any`	optional
multiple	`boolean`	optional	Allow multiple values (array value shape); mirrors FieldSchema.multiple.
accept	`string[]`	optional	Accepted upload types (MIME types / extensions) for file/image params.
maxSize	`integer`	optional	Max upload size in bytes for file/image params.
reference	`string`	optional	Reference target object for inline lookup/master_detail params; mirrors FieldSchema.reference.
defaultFromRow	`boolean`	optional
carryOver	`boolean`	optional	Carry-over param: seed the value from the current row (requires defaultFromRow: true), render it as a non-editable summary in the dialog, and submit it verbatim in the request body. Unlike `visible: false` (which omits the param from the submission entirely), a carry-over param is always sent.
visible	`string \| { dialect: Enum<'cel' \| 'cron' \| 'template'>; source: string; ast?: any; meta?: object }`	optional	Param visibility predicate (CEL); omits the param when false.
requiresFeature	`Enum<'twoFactor' \| 'organization' \| 'multiOrgEnabled' \| 'degradedTenancy' \| …>`	optional	Public auth feature flag gating this param; lowered into `visible` at parse time.

Action schema — UI Protocol property reference

On this page