Platform.Response
Control the HTTP response from CloudPages and JSON Code Resources — set status codes, content types, cookies, response headers, and perform redirects.
Platform.Response lets you control the HTTP response sent back to the browser. Useful for REST-style CloudPage APIs, redirects, cookie management, and setting response headers and content type.
Does not require Platform.Load.
Methods
| Method | Returns | Description |
|---|---|---|
Platform.Response.Write(content) |
void | Write content to the HTTP response output |
Platform.Response.SetResponseHeader(headerName, value) |
null | Set a response header |
Platform.Response.RemoveResponseHeader(headerName) |
null | Remove a response header |
Platform.Response.SetCookie(name, value [, expires [, secure]]) |
null | Set a response cookie |
Platform.Response.RemoveCookie(name) |
null | Attempt to remove a cookie |
Platform.Response.Redirect(url[, movedPermanently]) |
void | Redirect the browser |
Properties
| Property | Type | Description |
|---|---|---|
Platform.Response.ContentType |
setter with opaque read | Sets the Content-Type; reads do not return the configured string |
Platform.Response.CharacterSet |
setter with opaque read | Sets the character set; reads do not return the configured string |
Platform.Response.ContentType
VerifiedDiffers from docs
Platform.Response.ContentType = "application/json";
Sets the Content-Type header of the HTTP response. Set this before writing any output.
The property does not provide a useful JavaScript string getter. Assignment works and is reflected in the HTTP Content-Type header, but reading or calling it exposes an opaque platform value rather than the configured MIME type. Track the value in your own variable if you need to read it back.
Examples
Platform.Response.ContentType = "application/json";
Platform.Response.Write(Stringify({ status: "ok", id: newId }));
Platform.Response.ContentType = "text/plain";
Platform.Response.Write("plain text response");
// Does not return "application/json"; the runtime exposes an opaque platform value
var current = Platform.Response.ContentType;
// ✅ keep your own copy instead
var contentType = "application/json";
Platform.Response.ContentType = contentType;
Show test script
<script runat="server">
/*
* Chapter: Platform.Response.ContentType
* Proves:
* 1. Assignment works without Platform.Load.
* 2. A raw fetch reports Content-Type: text/plain; charset=UTF-8.
* 3. Reads and calls return opaque CLR values, not the configured string.
* EXPECTED OUTPUT: every assertion line starts with PASS.
*/
function assert(id, actual, expected) { Platform.Response.Write((actual === expected ? "PASS " : "FAIL ") + id + " -> [" + actual + "]\n"); }
function capture(fn) { try { return { threw: false, value: fn() }; } catch (ex) { return { threw: true }; } }
Platform.Response.ContentType = "text/plain";
Platform.Response.CharacterSet = "UTF-8";
var readResult = capture(function () { return Platform.Response.ContentType; });
var callResult = capture(function () { return Platform.Response.ContentType(); });
assert("ContentType read does not throw", readResult.threw ? "threw" : "returned", "returned");
assert("ContentType read returns CLR value", typeof readResult.value, "clr");
assert("ContentType call does not throw", callResult.threw ? "threw" : "returned", "returned");
assert("ContentType call returns CLR value", typeof callResult.value, "clr");
</script>
Platform.Response.CharacterSet
VerifiedDiffers from docs
Platform.Response.CharacterSet = "UTF-8";
Sets the character set of the HTTP response.
Like ContentType, assignment works and appears as the charset parameter in the HTTP Content-Type header, but reading or calling the property exposes an opaque platform value rather than the configured character-set string. Keep your own copy if you need it later.
Examples
Platform.Response.ContentType = "application/json";
Platform.Response.CharacterSet = "UTF-8";
Platform.Response.Write(Stringify(data));
Show test script
<script runat="server">
/*
* Chapter: Platform.Response.CharacterSet
* Proves:
* 1. Assignment works without Platform.Load and changes the charset token.
* 2. Reads and calls return opaque CLR values, not the configured string.
* EXPECTED OUTPUT: every assertion line starts with PASS.
*/
function assert(id, actual, expected) { Platform.Response.Write((actual === expected ? "PASS " : "FAIL ") + id + " -> [" + actual + "]\n"); }
function capture(fn) { try { return { threw: false, value: fn() }; } catch (ex) { return { threw: true }; } }
Platform.Response.ContentType = "text/plain";
Platform.Response.CharacterSet = "UTF-8";
var readResult = capture(function () { return Platform.Response.CharacterSet; });
var callResult = capture(function () { return Platform.Response.CharacterSet(); });
assert("CharacterSet read does not throw", readResult.threw ? "threw" : "returned", "returned");
assert("CharacterSet read returns CLR value", typeof readResult.value, "clr");
assert("CharacterSet call does not throw", callResult.threw ? "threw" : "returned", "returned");
assert("CharacterSet call returns CLR value", typeof callResult.value, "clr");
</script>
Platform.Response.Write
Platform.Response.Write(content)
Writes a string directly to the HTTP response output. Does not require Platform.Load.
This is distinct from the global Write() function. The global Write() requires Platform.Load("core", "1.1.5") and writes to the rendered page output. Platform.Response.Write() does not require Core and writes to the HTTP response body — use it in scripts where Core is not loaded.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
content |
string | Yes | String to write to the response |
Examples
// JSON API endpoint — no Platform.Load required
Platform.Response.ContentType = "application/json";
Platform.Response.Write(Stringify({ status: "ok" }));
// With Core loaded, either Write() or Platform.Response.Write() works
Platform.Load("core", "1.1.5");
var rows = DataExtension.Init("MyDE").Rows.Retrieve();
Platform.Response.Write(Stringify(rows));
Show test script
<script runat="server">
/*
* Chapter: Platform.Response.Write
* Proves:
* 1. Platform.Response and Write are available without Platform.Load.
* 2. Write appends the exact marker to the HTTP response body.
* 3. The bare Write alias is absent before Core and callable after Core.
* EXPECTED OUTPUT: every assertion line starts with PASS.
*/
function assert(id, actual, expected) { Platform.Response.Write((actual === expected ? "PASS " : "FAIL ") + id + " -> [" + actual + "]\n"); }
function typeOf(fn) { try { return fn(); } catch (ex) { return "threw"; } }
assert("Platform.Response is available without Platform.Load", typeOf(function () { return typeof Platform.Response; }), "clr");
assert("Write proxy is available without Platform.Load", typeOf(function () { return typeof Platform.Response.Write; }), "clrmethodinfo");
assert("bare Write is undefined before Platform.Load", typeOf(function () { return typeof Write; }), "undefined");
Platform.Load("core", "1.1.5");
assert("bare Write is callable after Platform.Load", typeOf(function () { return typeof Write; }), "function");
Platform.Response.Write("PASS Write appends exact body marker -> [WRITE-MARKER]\n");
</script>
Platform.Response.SetResponseHeader
Platform.Response.SetResponseHeader(headerName, value)
Sets a header on the HTTP response.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
headerName |
string | Yes | Name of the response header |
value |
string | Yes | Value for the response header |
Examples
Platform.Response.SetResponseHeader("Content-Type", "application/json");
Platform.Response.Write(Stringify({ status: "ok" }));
// Security headers
Platform.Response.SetResponseHeader("X-Content-Type-Options", "nosniff");
Platform.Response.SetResponseHeader("X-Frame-Options", "DENY");
The method returns JavaScript null. It is falsy, compares strictly equal to null, and has no properties or methods to inspect. Ignore the return value and use the raw HTTP header as the result.
The official reference declares a void return, but the CloudPage runtime returns JavaScript null.
Show test script
<script runat="server">
/*
* Chapter: Platform.Response.SetResponseHeader
* Proves:
* 1. The call sets X-Platform-Response: set-value on the raw response.
* 2. DEV: the call returns JavaScript null (official docs: void).
* EXPECTED OUTPUT: every assertion line starts with PASS; also inspect headers.
*/
function assert(id, actual, expected) { Platform.Response.Write((actual === expected ? "PASS " : "FAIL ") + id + " -> [" + actual + "]\n"); }
var returned = Platform.Response.SetResponseHeader("X-Platform-Response", "set-value");
assert("DEV SetResponseHeader returns strict null (official docs: void)", returned === null ? "null" : "not-null", "null");
assert("SetResponseHeader null is falsy", returned ? "truthy" : "falsy", "falsy");
</script>
Platform.Response.RemoveResponseHeader
Platform.Response.RemoveResponseHeader(headerName)
Removes a previously set HTTP response header.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
headerName |
string | Yes | Name of the response header to remove |
Examples
Platform.Response.RemoveResponseHeader("X-Powered-By");
The method returns JavaScript null. It is falsy and has no caller-facing API. Ignore it and verify that the named header is absent from the raw HTTP response.
The official reference declares a void return, but the CloudPage runtime returns JavaScript null.
Show test script
<script runat="server">
/*
* Chapter: Platform.Response.RemoveResponseHeader
* Proves:
* 1. A header set in the request is absent after removal.
* 2. DEV: the call returns JavaScript null (official docs: void).
* EXPECTED OUTPUT: every assertion line starts with PASS; also inspect headers.
*/
function assert(id, actual, expected) { Platform.Response.Write((actual === expected ? "PASS " : "FAIL ") + id + " -> [" + actual + "]\n"); }
Platform.Response.SetResponseHeader("X-Platform-Remove", "remove-me");
var returned = Platform.Response.RemoveResponseHeader("X-Platform-Remove");
assert("DEV RemoveResponseHeader returns strict null (official docs: void)", returned === null ? "null" : "not-null", "null");
</script>
Platform.Response.SetCookie
Platform.Response.SetCookie(name, value [, expires [, secure]])
Sets a cookie in the response.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
name |
string | Yes | Cookie name |
value |
string | Yes | Cookie value |
expires |
string or Date | No | Expiration datetime string or JavaScript Date object |
secure |
boolean | No | Send only over HTTPS |
Examples
// Session cookie (expires when browser closes)
Platform.Response.SetCookie("sessionToken", token);
function dateAdd(timestamp,intervalToAdd,intervalType) {
Platform.Variable.SetValue("@dateAdd_ts",timestamp);
Platform.Variable.SetValue("@dateAdd_add",intervalToAdd);
Platform.Variable.SetValue("@dateAdd_type",intervalType);
return Platform.Function.TreatAsContent("%%=DateAdd(@dateAdd_ts, @dateAdd_add, @dateAdd_type)=%%");
}
// Persistent cookie with expiry
function formatDate(dateString,dateFormat,timeFormat,isoLocale) {
Platform.Variable.SetValue("@formatDate_string",dateString);
Platform.Variable.SetValue("@formatDate_date",dateFormat);
Platform.Variable.SetValue("@formatDate_time",timeFormat);
Platform.Variable.SetValue("@formatDate_iso",isoLocale);
return Platform.Function.TreatAsContent("%%=FormatDate(@formatDate_string, @formatDate_date, @formatDate_time, @formatDate_iso)=%%");
}
var expiry = formatDate(
dateAdd(Now(), 30, "D"),
"ddd, DD MMM YYYY HH:mm:ss",
"en-US"
) + " GMT";
Platform.Response.SetCookie("rememberMe", userId, expiry, true);
// Clear a cookie by sending an empty value with a past Date
Platform.Response.SetCookie("sessionToken", "", new Date(1970, 0, 1), true);
Each call returns JavaScript null. It is falsy and carries no cookie details. Ignore the return value and inspect the raw Set-Cookie header for the name, value, expiry, and secure attribute.
The official reference declares a void return, but the CloudPage runtime returns JavaScript null.
Show test script
<script runat="server">
/*
* Chapter: Platform.Response.SetCookie
* Proves:
* 1. The two-argument form emits a session Set-Cookie header.
* 2. Expiry and secure arguments appear in a second Set-Cookie header.
* 3. DEV: both calls return JavaScript null (official docs: void).
* EXPECTED OUTPUT: every assertion line starts with PASS; also inspect headers.
*/
function assert(id, actual, expected) { Platform.Response.Write((actual === expected ? "PASS " : "FAIL ") + id + " -> [" + actual + "]\n"); }
var sessionReturn = Platform.Response.SetCookie("platformResponseSession", "session-value");
var secureReturn = Platform.Response.SetCookie("platformResponseSecure", "secure-value", "Thu, 01 Jan 2037 00:00:00 GMT", true);
assert("DEV SetCookie session returns strict null (official docs: void)", sessionReturn === null ? "null" : "not-null", "null");
assert("DEV SetCookie secure returns strict null (official docs: void)", secureReturn === null ? "null" : "not-null", "null");
</script>
Platform.Response.RemoveCookie
Platform.Response.RemoveCookie(name)
Attempts to remove a browser cookie from a CloudPage response. In the tested published CloudPage GET, the method returned null but emitted no Set-Cookie deletion header, even when the request contained the named cookie. It is therefore ineffective for its intended CloudPage use in the tested runtime.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
name |
string | Yes | Name of the cookie to remove |
Examples
// RemoveCookie returned null but emitted no deletion header in the tested runtime
Platform.Response.RemoveCookie("sessionToken");
// Proven workaround: emit an expired cookie with the same name and path
Platform.Response.SetCookie("sessionToken", "", new Date(1970, 0, 1), true);
The method returns JavaScript null, which is falsy and contains no deletion result. Use SetCookie(name, "", pastDate, secure) instead: a JavaScript Date in the past emitted an empty, expired Set-Cookie header with path=/, and a cookie-jar client omitted the cookie on the next request.
Platform.Request.GetCookieValue() reads the incoming request. It can still return the old value during the request that sends the deletion header; confirm removal on a subsequent request.
The official reference says the method expires the cookie and declares a void return. In a published CloudPage GET with the named cookie present, the method returned JavaScript null and emitted no Set-Cookie header. The proven CloudPage workaround is SetCookie(name, "", new Date(1970, 0, 1), true), which emitted an empty cookie with a past expiry and removed it from the next cookie-jar request.
Show test script
<script runat="server">
/*
* Chapter: Platform.Response.RemoveCookie
* Run modes with raw headers and a cookie jar:
* 1. ?mode=seed emits platformResponseDeleteFinal=present-value.
* 2. Send that cookie to ?mode=remove: RemoveCookie returns JavaScript null,
* the incoming value remains readable, and no Set-Cookie header is emitted.
* 3. Re-seed and send the cookie to ?mode=fallback: SetCookie with an empty
* value and past JavaScript Date emits an expired cookie with path=/.
* 4. A subsequent ?mode=check request has no incoming cookie.
* EXPECTED OUTPUT: every assertion line starts with PASS; raw headers prove deletion.
*/
function assert(id, actual, expected) { Platform.Response.Write((actual === expected ? "PASS " : "FAIL ") + id + " -> [" + actual + "]\n"); }
var mode = Platform.Request.GetQueryStringParameter("mode");
var cookieName = "platformResponseDeleteFinal";
if (mode === "seed") {
var seedReturn = Platform.Response.SetCookie(cookieName, "present-value");
assert("seed returns strict null", seedReturn === null ? "null" : "not-null", "null");
}
if (mode === "remove") {
var inbound = Platform.Request.GetCookieValue(cookieName);
var removeReturn = Platform.Response.RemoveCookie(cookieName);
assert("request cookie is present before RemoveCookie", inbound, "present-value");
assert("DEV RemoveCookie returns strict null (official docs: void)", removeReturn === null ? "null" : "not-null", "null");
}
if (mode === "fallback") {
var inboundFallback = Platform.Request.GetCookieValue(cookieName);
var fallbackReturn = Platform.Response.SetCookie(cookieName, "", new Date(1970, 0, 1), true);
assert("request cookie is present before fallback", inboundFallback, "present-value");
assert("Date fallback returns strict null", fallbackReturn === null ? "null" : "not-null", "null");
}
if (mode === "check") {
var afterDeletion = Platform.Request.GetCookieValue(cookieName);
assert("cookie is absent on subsequent request", String(afterDeletion), "null");
}
</script>
Platform.Response.Redirect
VerifiedDiffers from docs
Platform.Response.Redirect(url[, movedPermanently])
Redirects the browser to the specified URL.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
url |
string | Yes | Destination URL |
movedPermanently |
boolean | No | true for a 301 permanent redirect, false or omitted for a 302 temporary redirect |
Two behaviours the official docs do not state. First, the second argument is optional — a single-argument call produces a 302 with the Location header set, exactly like passing false. Second, the redirect terminates the script immediately: statements after the call never run, not even when the call sits inside a try/catch (no catchable exception is raised). Any response body written before the call is discarded in favour of the redirect payload.
Examples
// Temporary redirect (302) — the flag is optional
Platform.Response.Redirect("https://example.com/thank-you");
Platform.Response.Redirect("https://example.com/thank-you", false);
// Permanent redirect (301)
Platform.Response.Redirect("https://new-domain.com/page", true);
// Conditional redirect
var isLoggedIn = !!Platform.Request.GetCookieValue("session");
if (!isLoggedIn) {
Platform.Response.Redirect("/login?next=" +
Platform.Function.UrlEncode(Platform.Request.RequestURL), false);
}
Redirect() ends the script on the spot — nothing after the call executes, and any output written before it is thrown away. Do not rely on cleanup code placed after a redirect, and do not expect a try/catch around it to regain control. Use a 301 only when browsers should stop re-checking the original URL.
Show test script
<script runat="server">
/*
* Chapter: Platform.Response.Redirect
* Proves with raw fetches and automatic redirects disabled:
* 1. One argument returns 302 and the exact Location header.
* 2. false returns 302; true returns 301.
* 3. DEV: Redirect terminates immediately and discards earlier body output.
* EXPECTED OUTPUT: HTTP 302 plus Location; redirect payload replaces PASS output.
*/
Platform.Response.Write("FAIL output before redirect must be discarded\n");
Platform.Response.Redirect("https://example.com/platform-response-default");
Platform.Response.Write("FAIL output after redirect must be unreachable\n");
</script>