> ## Documentation Index
> Fetch the complete documentation index at: https://docs.requestly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Import packages into your scripts

> Learn how to import external libraries in Requestly scripts using require to extend functionality with modules like moment, lodash, and uuid.

You can use the `require` method to import preloaded libraries or global helpers directly inside your **Requestly Script Tab** in API Client requests.

The script environment supports JavaScript-based transformations, validations, and dynamic request logic for HTTP and GraphQL APIs.

<iframe className="w-full aspect-video rounded-xl" src="https://www.youtube.com/embed/C21BaqCOxF0?si=8vv_iOh1d4xEqeK3" />

## **require**

The `require` method lets you import supported modules into your script. Declare the result as a variable to access functions or objects from that module.

### **Syntax**

```javascript theme={null}
const variableName = require('module-name');
```

If the module provides functions or objects, assign it to a variable as shown above.

### **Example**

```javascript theme={null}
// Importing moment for date formatting
const moment = require('moment');

const current = moment().format('YYYY-MM-DD HH:mm:ss');
console.log('Current Time:', current);

// Importing uuid to generate unique IDs
const { v4: uuidv4 } = require('uuid');
console.log('Generated ID:', uuidv4());
```

## **Use Global Objects**

Requestly script sandbox provides several global variables and utilities you can access directly.

### **Available Globals**

| **Global** | **Description** | **Example** |
| :- | :- | :- |
| **require** | Import supported libraries into your script. | `const moment = require('moment');` |
| **xml2Json** | Convert XML string to JSON object. | `const data = xml2Json(rq.response.text());` |
| **\_** | Lodash global for data manipulation utilities. | `const result = _.map([1,2,3], n => n * 2);` |

## **Use External Libraries**

The `require` method enables you to use preloaded libraries in the Requestly script environment.

All supported modules are sandboxed for safe execution.

### **Supported Libraries**

The following external libraries are available:

| Library | Description | Documentation |
| :- | :- | :- |
| **ajv** | JSON Schema validator for validating API responses. | [Ajv Docs](https://ajv.js.org/) |
| **chai** | Assertion library for adding test-like validations in scripts. | [Chai Docs](https://www.chaijs.com/api/) |
| **cheerio** | Parse and manipulate HTML/XML using a jQuery-like syntax. | [Cheerio Docs](https://cheerio.js.org/) |
| **crypto-js** | Hashing and HMAC utilities. Also available as the bare `CryptoJS` global. | [crypto-js Docs](https://www.npmjs.com/package/crypto-js) |
| **csv-parse/lib/sync** | Parse CSV data synchronously into objects. | [csv-parse Docs](https://csv.js.org/parse/) |
| **lodash** | Utility library for data manipulation. | [Lodash Docs](https://lodash.com/docs) |
| **moment** | Library for date and time formatting and manipulation. | [Moment.js Docs](https://momentjs.com/docs/) |
| **uuid** | Generate unique identifiers (UUID v4, etc.). | [uuid Docs](https://www.npmjs.com/package/uuid) |
| **xml2js** | XML parsing and building utilities. | [xml2js Docs](https://www.npmjs.com/package/xml2js) |

## Install a package from npm

You are not limited to the libraries above. On the **desktop app**, `require()` any package from npm and
Requestly installs it when the request is sent:

```javascript theme={null}
// Latest version
const jwt = require('jsonwebtoken');

// Pinned to a version
const jsrsasign = require('jsrsasign@11.1.0');
```

Search for and manage installed packages from the **Package Library**.

<Note>
  npm packages and Custom Packages are **desktop-only**. On the web app, `require()` resolves the built-in
  libraries listed above but has no user-package tier.
</Note>

### If your organization restricts external packages

An organization Owner or Admin can limit which external packages scripts may import, or block them
entirely, from **Settings > Organization > Resources**. Where a package is not permitted, installing it is
refused and a script that requires it is blocked when the request runs, with a message naming the package.
Requestly's built-in libraries are exempt and always resolve. See
[Organization resources](/account/organization-resources).

## Require your own code as a package

To reuse a helper across requests without repeating it, author it in the **Package Library** and require it
by name with a `.js` suffix:

```javascript theme={null}
const helpers = require('signing-helpers.js');

const signature = helpers.sign(rq.request.body ?? '');
```

A Custom Package belongs to the project it was created in. To use one in another project, export it and
import it there.

<Tip>
  To share a helper only between the scripts of a single run — a collection-level script and the requests
  beneath it — you do not need a package at all. See
  [Sharing code between scripts](/api-client/scripts#sharing-code-between-scripts).
</Tip>

**Example**

```javascript theme={null}
const moment = require('moment');
const { v4: uuidv4 } = require('uuid');
const CryptoJS = require('crypto-js');

const id = uuidv4();
const time = moment().format('HH:mm:ss');
const digest = CryptoJS.SHA256(id).toString();

console.log('Request ID:', id, 'Time:', time, 'Digest:', digest);
```

## **Use Built-in Globals**

Requestly also provides a few helper functions and contextual variables for working with request and response data.

### **Examples**

```javascript theme={null}
if (rq.response.code === 200) {
  const parsed = xml2Json(rq.response.text());
  console.log('Converted XML:', parsed);
}

const upper = _.toUpper('requestly');
console.log(upper);
```

## **Notes**

* A set of Node.js built-in modules is also available via `require()`. In **Safe** mode — the default —
  these resolve: `crypto`, `buffer`, `events`, `util`, `stream`, `zlib`.
* These do **not** resolve in Safe mode and throw a guided error naming the reason: `assert`, `path`,
  `punycode`, `querystring`, `string_decoder`, `url`. Modules that need the filesystem, a network socket,
  or a child process (`fs`, `net`, `child_process`) are never available.
* `require('cheerio')` does not currently load in Safe mode. Use Developer mode if you need it.
* The built-in libraries need no installation or internet access; they are pre-bundled. Packages you install
  from npm are fetched once, then cached.
* The sandbox is isolated for security: `require()` cannot reach system-level Node APIs.

<Note>
  These restrictions apply in **Safe Mode**, the default. A package that needs a native add-on or
  file-system access works only in **Developer Mode**. Asymmetric signing itself is not restricted — it is
  `require('crypto')`'s asymmetric functions (`createSign`, `generateKeyPair` and friends) that are
  unavailable in Safe mode, while a pure-JavaScript library such as `jsrsasign` signs RS256 in either mode.
  See [Script execution modes](/api-client/rq-api-reference/overview#script-execution-modes).
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.