Removes low-code API resources, which have not been released in any rc or stable version. Builds on #23077; the schema and documentation in the ABP repository are removed in abpframework/abp#26341.

Removed

API resources from #22936, #22946, #22990 and #22940, together with their later follow-ups:

• The apiResources model descriptor, its merger, serializer, materializer and mutation targets, layer override features and validation rules.
• The runtime API resource service and controller (api/low-code/api-resources/...), the resource contract, grouped records, lookups and the API resource query script context.
• API resource permissions (LowCode.ApiResources.* and the generated operation permissions) and the API resource resource-permission target.
• API resource entries in the reference catalog, deletion plans, deleted objects and former usages, the health snapshot and advisor, change summaries and the designer MCP tools (apiResource authoring topic, API resource tools).
• The designer's API resources screens and the resource-aware paths in the @volo/abp-react-lowcode SDK (useApiResource, apiResource() sources, record/contract adapters).
• The demo's product-feed API resource and the API-resource-only tests.

Kept

These came in the same pull requests but are not tied to API resources:

• Authorization decided once at the operation entry point; interceptors, endpoints and jobs read the app's data without the caller's grants narrowing them.
• Resource permission audience search for pages, endpoints and apps.
• Smaller designer tool payloads, allowed values in target contracts, one validation reply for every malformed operation, receipts from apply_rollup/apply_formula, and lowcode_designer_test_scripts.
• Input validation running after Pre interceptors.
• Setting aside an app whose stored descriptor is rejected (AppDescriptor.RuntimeFault, LowCode:AppModelRejected).
• Health warnings that are not about API resources; the one about entity interceptors branching on the caller's permission now points to page interceptors.

Tests that covered general behavior through an API resource were moved onto pages or forms.

Stored models

There is no compatibility path for the removed descriptor. A stored runtime model that still has an apiResources key is not loaded ("Unknown model descriptor category"), so such a key has to be removed from existing data.

Tests

The low-code module and demo test projects pass, except for the formula tests that already fail on dev and are fixed in #23076. Typecheck and Vitest pass for both React packages, apart from tests that already fail without this change.

11.0.0-rc.2 12 November, 2026 No labels