Skip to main content
An organization Owner or Admin can decide what everyone in the organization is allowed to do in Requestly. Those controls live under Settings > Organization > Resources, and each individual control is called a resource. Two resources are governed today, both in the Scripts & packages section:
Resources is enabled per organization. If you are an Owner or Admin and the entry is missing under Settings > Organization, contact Requestly support.

​
Who can change a policy

Only an organization Owner or Admin can change a policy. Everyone else in the organization sees exactly the same pages, read only: the list carries a quiet Read only - you can view these settings. line, and the resource’s own page states You can view this policy but not change it, along with who to ask. There is no error page and no redirect, so a member can always see what applies to them and who set it. Every row and every resource page also names who changed the policy last and when. Only the latest change is recorded, so there is no history to browse.

​
Change a policy

1

Open Resources

Go to Settings, open the Organization group and select Resources. Each row names the resource, describes what it controls, and shows the choice that currently applies.
2

Open the resource

Click anywhere on the row. The resource gets its own page, where each option is listed with the consequence of choosing it.
3

Choose an option

Options are listed least restrictive first. Selecting one shows what it means for your members before you commit to it.
4

Curate the list, if the option carries one

Some options reveal a list panel. Add and remove entries there. Nothing is written until you save.
5

Save

Click Save in the page header. Save stays unavailable until you change something, and Cancel discards the draft. A successful save returns you to the Resources list.

​
External packages

This resource controls which external packages scripts in this organization may import with require(). See Import packages into your scripts for what require() can load.
Requestly’s built-in library is always available and is exempt from this policy. Packages bundled with Requestly resolve whatever you choose here, including under Deny. This setting controls external packages only.
That exemption covers everything Requestly ships in the sandbox, reached either by name through require() (for example require('crypto-js')) or through the convenience globals _, CryptoJS and xml2Json.

​
Curate the approved list

Choosing Allow selected reveals an Approved packages panel. Two entry forms are accepted:
  • axios permits any version of that package.
  • [email protected] permits only that release.
Add an entry with Add or by pressing Enter. To add several at once, paste them into the field separated by newlines, commas, semicolons or spaces. Duplicates are rejected with a message rather than silently dropped, so if you meant to change a package’s version, remove the existing entry first. Requestly does not verify that an approved package exists. A well-formed name that no registry resolves is still accepted, which is what lets you approve a private or not-yet-published package.
Pinning a version permits only that release and blocks an unversioned require() of the same package. Most scripts do not specify a version, so most scripts break when you pin one.
Saving Allow selected with an empty list is blocked, because an empty approved list denies every external package, which is what Deny already means. The Save button explains itself with “Add at least one entry, or choose Deny.”, and the panel offers Choose Deny instead as the way out.

​
What a governed member sees

Under Allow selected or Deny, a script that imports a package the policy does not permit is blocked when the request runs, with a message naming the package: Package 'some-package' is blocked by your organization's package policy. Ask an admin in your organization to approve it. Installing such a package from the Package Library is refused for the same reason.

​
Script mode

This resource controls whether members of this organization can run a request’s scripts in Developer mode. Safe mode is what every request opens in either way. See Script execution modes for what the two modes do. Developer mode reaches the host machine: scripts running in it can read files, run shell commands and open raw sockets on the member’s machine. Safe mode is still what every request opens in, so this setting decides whether a member may leave it. Under Safe mode only, members see Developer mode marked unavailable rather than hidden. The per-request mode control keeps showing the mode, so a member who reaches for it learns their organization set this instead of discovering it from a script that failed.

​
Developer mode in the CLI

rq collection run --script-execution-mode developer requires credentials and is refused when the policy is Safe mode only. A run that passes no mode flag, or passes safe, needs no credentials and is unaffected. See Script execution mode and your organization’s policy.

​
How enforcement works

Policies apply to everyone in the group, including the admins who set them. Enforcement is performed by the Requestly app on each member’s machine, in every project, including local ones. It is not enforced at the network level or on our servers. The Resources page states this once, behind the How enforcement works link next to the enforcement line, together with the surfaces each resource is enforced on. A change can take up to a minute to reach a member’s machine, and a run already in progress finishes on the policy it started with.
An out-of-date desktop app does not apply these policies. Policies you set are saved and apply on every up-to-date app, and the Resources page replaces its enforcement line with an update prompt when the app you are reading it in is too old to apply them.
Where a policy denies something, Requestly explains itself rather than failing silently: the restricted surface names what was restricted and says it “has been restricted by your organization’s admin.” It does not offer a workaround, so it will not suggest installing the desktop app to reach something your admin denied.

​
Defaults

A resource with no policy set is Allow all. There is no separate “not set” state, so a resource you have never touched behaves exactly as it did before Resources existed, and a newly added resource appears set to Allow all. If loading the policies fails, the page says so rather than showing every resource at its default. Any policies your organization has set stay in force while the page cannot display them.