First Class Modules

Web links

Maintains searchable, categorized, location-aware external links with descriptions, custom fields, relationships, activity, and favorites.

Runtime key
module.web-links
Experience
Curated external resources
Security
Server-enforced

Use Web Links to curate external tools, reference sites, customer resources, vendor portals, or research alongside the records and teams that use them.

Note

The bundled renderer key is module.web-links. First-class means BuildWithHQ supplies a native, typed, secured runtime experience inside normal app provisioning and the signed-in user's existing permissions.

What it does

Maintains searchable, categorized, location-aware external links with descriptions, custom fields, relationships, activity, and favorites.

Key capabilities

  • Search links and filter them by category.
  • Create and edit title, URL, description, category, and custom fields.
  • Open only contract-validated HTTP or HTTPS destinations in an isolated browsing context.
  • Relate and favorite links while preserving location-aware access.

Common uses

  • Team resource directories.
  • Customer/vendor portals and external documentation.
  • Research links connected to cases, projects, accounts, or knowledge.

How it connects

Links can relate to Knowledge Articles, Contacts, projects, and dynamic records. They store the reference and business context, not credentials or an embedded authenticated browser session.

Where applicable, its records use the universal RecordId conventions so they can participate in secured relationships, activity history, favorites, dynamic fields, notifications, Inbox attention, and global search without copying the source record.

Security and data boundary

The server accepts strict host-based HTTP(S) URLs without embedded credentials. The runtime opens destinations with an isolated external context and applies normal tenant, DataRole, and location checks to the link record.

  • The authenticated service derives the SaaS app, tenant account, user, DataRole, and location scope; browser identifiers are never authorization proof.
  • The page editor composes React components with validated data bindings. Those bindings call typed runtime APIs, whose application services execute reviewed stored procedures.
  • List, search, detail, relation, activity, favorite, and write operations reapply their required server-side permissions.

Add it to an app

  1. Open the SaaS app in the Developer Console and identify the user journey and page where this module belongs.
  2. Add the validated module.web-links module block through the supported page/template authoring flow.
  3. Configure the module with the page editor's React components and validated data bindings; the bindings call authenticated platform APIs backed by reviewed stored procedures.
  4. Place the page in the correct user-type menus and assign existing DataRole, record, field, and location permissions.
  5. Test list, detail, search, empty, denied, stale-update, and cross-location behavior before publishing an exact version.
Tip

Store the public destination only. If an integration needs OAuth or an API secret, use a managed connector instead of putting credentials in a URL.

Important

A renderer being bundled in the tenant application does not make its data visible in every app. The server returns only components and records authorized for the current app and signed-in user; unavailable or unauthorized blocks fail closed.