SuperIT workflow sandbox and runtime reference

Runtimes, installed modules, inputs, environment variables, network, timeouts, size limits, credits and device runs for actions

This page lists the facts you need to write an action script: what each runtime provides, how inputs and credentials reach the script, what the cloud sandbox can reach, and the limits that apply in the sandbox and on devices.

Runtimes

Runtime (UI label)	Where it runs	What's installed
PowerShell	Cloud sandbox or a device	Sandbox: PowerShell 7 with the ExchangeOnlineManagement module 3.9.2. The Microsoft.Graph PowerShell SDK isn't installed, so `Connect-MgGraph` fails; call Graph with `Invoke-RestMethod`. On a device: Windows PowerShell (`powershell.exe`) with whatever the device has installed.
Python	Cloud sandbox only	Python 3 standard library and the `playwright` package. `pip` isn't available, so you can't install other packages.
Playwright/Python	Cloud sandbox only	Playwright 1.63 for Python with Chromium, launched headless for you. Scripts are Python, not TypeScript.

Each cloud run gets a fresh container that's discarded afterwards, so nothing persists between runs. PowerShell and Python runs get 512 MiB of memory; Playwright runs get 2 GiB.

Script contract

	PowerShell	Python	Playwright/Python
Read an input	`$ctx.inputs.<name>`	`input_context["<name>"]`	`input_context["<name>"]`
Optional input left blank	`$null -eq $ctx.inputs.<name>`	`input_context.get("<name>")` is `None`	as Python
Injected objects	`$ctx`	`input_context`	`page`, `browser_context`, `input_context`
Return structured output	Set `$result = @{ ... }`	Assign a top-level `result`	Assign a top-level `output`
Log a line	`Write-Output`	`print()`	`print()`
Fail the run	Throw an error or exit non-zero	Raise an exception or exit non-zero	Raise an exception

PowerShell scripts start with $ErrorActionPreference = "Stop" already set, so any error stops the script and fails the run.
Playwright scripts may use top-level await, for example await page.goto(url).
Read inputs from $ctx or input_context, not from a param() block.

Inputs

Type in the editor	The person running it sees	The script receives
string	A text box	What they typed
textarea	A multi-line box	What they typed
email	An email box, format-checked	`"[email protected]"`
boolean	An on/off switch	`"true"` or `"false"`
date	A date picker	`"2026-01-31"` (YYYY-MM-DD)
select	A list of the choices	One choice, exactly as written
string[]	A comma-separated text box	`"a, b, c"`; split it yourself

Every input arrives as a string. Compare booleans explicitly: if ($ctx.inputs.notify -eq 'true') in PowerShell, if input_context["notify"] == "true": in Python. A plain if treats "false" as true.
A blank optional input is absent. Default values in the editor aren't passed to the script, so handle the missing case yourself.
A Required boolean must be switched on to run. Use it for confirmations.
SuperIT checks required inputs, select choices, email format, dates and unknown input names before the run starts.

Environment variables

Variable	Contains
`CREDENTIAL_<NAME>_TOKEN`	For an OAuth credential, such as Microsoft Graph: a fresh access token. Send it as `Authorization: Bearer <token>`.
`CREDENTIAL_<NAME>_<HEADER>`	For an API key credential: the full value of that header, for example `Bearer …` or `Basic …`.

<NAME> and <HEADER> are the credential name and header name in upper case, with every run of other characters replaced by _. For example, "M365 Graph (tenant)" gives CREDENTIAL_M365_GRAPH_TENANT_TOKEN. Read them with $env:NAME in PowerShell or os.environ["NAME"] in Python. See Credentials.

Network

The cloud sandbox can reach the public internet. If a vendor restricts API access by IP address, email [email protected].
The sandbox runs in SuperIT's cloud and has no route to your private networks. To reach something inside a client's network, run a PowerShell action on a device there.
Scripts run as an unprivileged account.

Timeouts

Limit	Value
Script timeout, cloud sandbox	5 minutes by default; set Script timeout (minutes) up to 60
Script timeout, device	5 minutes by default; set Script timeout (minutes) up to 60
Waiting for approval	7 days, then the run ends with "Approval expired"

Limits

Limit	Value
Script, inputs and credentials together	About 28 KiB. A larger run fails before the script starts, so keep scripts short.
Stored output	256 KB each for Stdout and Stderr; longer output is truncated with a marker.
Retries	None. A failed run isn't retried automatically.
Script length per action	One script. Actions can't call other actions.

Credits

Runs use SuperIT credits, shown under the Workflows billing category. For current pricing, see superit.ai.

Test runs aren't billed. Runs that never start, for example because they were rejected or cancelled before launch, aren't billed.

Device runs

Runtime: PowerShell only, in Windows PowerShell on the device.
Devices: online Windows devices with the SuperIT RMM agent. macOS and Linux devices can't run actions.
Account: the script runs as SYSTEM, with no signed-in user session, so it can't show anything to the user or reach their mapped drives or user profile settings directly.
Setup: the action must be set to run on a device. See Set an action to run on a device.
Credentials: linked credentials are passed to the device as environment variables for the run.
Testing: Test isn't available for device actions.
Output: the SuperIT RMM agent keeps the first and last 128 KiB of each output stream.
Policies: the action's authorization policy applies. Command policies don't, so the authorization policy is the only check. Don't let Anyone run a device action without approval. See Authorization policies and approvals.
Ticket recommendations: a device action started from a ticket recommendation isn't necessarily sent to the ticket contact's device, so leave Run automatically off for device actions.