Blocks

A block renders a tile's result. The block type selects the renderer; config configures it. Available types: plotly, plotly_resampler, table, markdown, image, raw_html, input_select, input_range.

plotly

Renders a Plotly figure. Bind dataframe columns into the figure spec with the @column convention — StrataBI replaces "@col" with that column's values:

json

{
  "type": "plotly",
  "config": {
    "figure": {
      "data": [{ "type": "scatter", "x": "@month", "y": "@revenue" }],
      "layout": { "margin": { "t": 10 } }
    },
    "height": "360px"
  }
}

config also accepts template (a Plotly template name or ?source), style, and graph_config. plotly_resampler takes the same config and is intended for large series.

table

An AG Grid table. Runtime results are expected to be dataframes (parquet or csv).

json

{ "type": "table", "config": { "page_size": 25, "height": "480px" } }

config accepts column_defs, default_col_def, dash_grid_options, className, and style. If column_defs is omitted, columns are inferred from the dataframe.

markdown / image / raw_html

json

{ "type": "markdown", "config": { "content": "# Title\n\nBody text." } }
{ "type": "image",    "config": { "src": "s3://.../chart.png", "width": "100%" } }
{ "type": "raw_html", "config": { "html": "<b>Trusted</b>", "height": "500px" } }
{ "type": "raw_html", "config": { "html": "<div>…</div>", "sandbox": "allow-scripts allow-popups" } }

These accept literal content or a ?source value, and runtime-generated artifacts (md, png/jpg/webp/svg, html) can also populate them.

Caution

raw_html renders arbitrary HTML in an iframe and is an injection surface. Only use it with content you control. When RBAC is enabled, a raw_html block renders only from a governed source; otherwise it needs the Raw HTML role permission and users without it see a "Restricted" placeholder. The only governed source is a module (a lambda exec tile); a pinned (admin-curated) dashboard is the admin escape hatch. Everything else is rejected — including HTML loaded from the S3 cache (cache exec): storage location is not governance, so cached HTML is treated as untrusted. To show such HTML, render it through a governed module, pin the dashboard, or hold the Raw HTML permission. See Roles & access control. As a second layer, the HTML renders inside a sandboxed iframe. The default sandbox is allow-scripts allow-popups — scripts and charts still run, but the frame is a null origin, so even permitted or pinned HTML cannot read the viewer's session cookie, localStorage, or call your app's APIs as that user. Override per block with the sandbox config (a space-separated token list); set it to null to remove the sandbox entirely for a fully trusted embed. Avoid adding allow-same-origin together with allow-scripts — that combination lets the frame remove its own sandbox.

input_select / input_range

Input blocks write a value to the dashboard input store under input_id, which downstream tiles consume. See Inputs & parameters.

json

{
  "type": "input_select",
  "config": {
    "input_id": "region",
    "component": "dropdown",
    "options": [{ "label": "North", "value": "north" }],
    "value": "north"
  }
}

input_select supports dropdown, radio, and checklist components, and options may be inline, ?source-resolved, or returned by a JSON execution result. input_range takes min, max, step, and a single value (slider) or two-value array (range slider).