# Accessing platform services

> Orchestrator assets, buckets, queues, and processes available to a JavaScript function through the UiPath TypeScript SDK, with the choice between delegated and function identity.

JavaScript functions reach platform resources through the [UiPath TypeScript SDK](https://uipath.github.io/uipath-typescript/). Nothing is hardcoded in the package: the coordinates come from [`ctx.platform`](javascript-function-context.md) and the token from one of the two identities the runtime supplies.

```typescript

const { baseUrl, orgId, tenantId } = ctx.platform;
const sdk = new UiPath({
  baseUrl,
  orgName: orgId,
  tenantName: tenantId,
  secret: ctx.user.accessToken,   // or ctx.robot.accessToken
});
```

`@uipath/uipath-typescript` belongs in `dependencies`, not `devDependencies`: the deployed function installs production dependencies only.

## Choosing the identity

| Pattern | Token | Who needs folder access |
|---|---|---|
| **Delegated** | `ctx.user.accessToken` | The calling user needs `Assets.View` on the folder |
| **Function identity** | `ctx.robot.accessToken` | Only the function's service account; the caller needs nothing |

Delegated is the default choice: the caller's own permissions apply, so the function cannot be used to see more than the caller is entitled to. The function's own identity is for resources that must stay out of the caller's reach — a credential in a restricted folder that only the function may read.

In that case, what the handler fetches must be constrained. A privileged backend that reads a caller-supplied resource name will hand over anything its identity can see:

```typescript
const READABLE = new Set(["PartnerApiCredential"]);

if (!READABLE.has(input.assetName)) {
  throw new FunctionError(`"${input.assetName}" is not readable by this function.`, 403);
}
```

## Assets

```typescript
const response = await new Assets(sdk).getAll({
  filter: `Name eq 'ApiBaseUrl'`,
  folderId: 42,
});
const value = response.items[0]?.value;
```

`folderId` is required: without it the call returns metadata with empty values.

`folderId` is the folder's **numeric** id, not its key. A folder key is a GUID, and passing one where the numeric id belongs is rejected as a permissions error rather than a bad identifier, which sends you looking in the wrong place. `ctx.platform.folderKey` gives you the key of the current invocation; resolve the numeric id from it when a call needs one.

:::note
A Credential asset's username and password are not returned by these endpoints, for any token. Reading one requires the function's own identity and the robot-execution route, which needs `ctx.robot.key` — so it works only in a deployed run. See [Calling Orchestrator](https://uipath.github.io/uipath-typescript/js-functions/calling-orchestrator/).
:::

For a **Secret** asset, the value arrives in the `SecretValue` field. `StringValue`, the field that carries a Text asset's value, is empty for a Secret — reading it instead looks like a broken feature rather than the wrong field.

An asset also has an `AllowDirectApiAccess` setting that makes its value readable with the caller's own token. Turning it on is a widening, not an enablement step: the setting is identity-blind, so the value becomes readable by every identity holding `Assets.View` on the folder, including a browser holding the signed-in user's token. The function's own identity is the safer choice over enabling this setting.

## Other services

The same client exposes buckets, queues, jobs, processes, entities, and Integration Service connections. See the [SDK reference](https://uipath.github.io/uipath-typescript/) for the full surface.

## Credentials and security

- Secrets live in Orchestrator assets and are read at runtime — never hardcode them or commit them to the project.
- Folder-level role-based access control (RBAC) governs what each identity can read. With the delegated pattern that is the caller's access; with the function's own identity it is the service account's.
- Return a derived result rather than a secret wherever you can, and log the action, never the value.

## Next steps

- [Packaging and publishing](packaging-and-publishing.md)
- [Testing and debugging](javascript-testing-and-debugging.md)