diff --git a/src/posts/sheets-api-import-image-external-url.md b/src/posts/sheets-api-import-image-external-url.md new file mode 100644 index 00000000..0118c5f7 --- /dev/null +++ b/src/posts/sheets-api-import-image-external-url.md @@ -0,0 +1,55 @@ +--- +layout: post +title: "Google Sheets API - IMPORT / Image - Bypass User Consent" +excerpt: "Use the Spreadsheets v4 API to set the importFunctionsExternalUrlAccessAllowed property to true and allow access to external URLs without requiring user consent." +tags: + - post + - code + - google + - google workspace + - sheets + - privacy +date: "2024-04-24T00:00:00.000Z" +hideToc: true +--- + +Accessing data from external parties in Google Sheets is now blocked by default. This change affects any spreadsheets that use the `IMAGE` or `IMPORT` functions to import data from external URLs. Users will now need to grant permission to access external data before the functions can be used. This warning shows up as: + +> Warning: Some formulas are trying to send and receive data from external parties. + +This issue was reported in the [Sheets API Issue Tracker](https://issuetracker.google.com/issues/324798866). The change is intended to improve privacy and security by preventing unauthorized access to external data sources. + +Developers using the Sheets API and creating PDF reports or similar will need to make a change to the spreadsheet to work around this. The engineering team at Google has provided the following guidance: + +> We are working on adding options to the Google Sheets API and the Apps Script Sheets integration to support acknowledging the import warning on a per-document basis (essentially mimicking the user flow, although it can be done in advance of adding any IMPORT-related formulas). + +As part of the [Spreadsheets v4 API](https://developers.google.com/sheets/api/reference/rest/v4/spreadsheets#spreadsheetproperties), there is now a new property: + +```js +{ + "importFunctionsExternalUrlAccessAllowed": boolean +} +``` + +The comment for this property reads: + +> Whether to allow external URL access for image and import functions. Read only when true. When false, you can set to true. + +The property is set to `false` by default. Developers can use the `spreadsheets.batchUpdate` method in the Sheets API to set this property to `true` and allow access to external URLs for the `IMAGE` and `IMPORT` functions without requiring user consent. + +```js +{ + "requests": [ + { + "updateSpreadsheetProperties": { + "properties": { + "importFunctionsExternalUrlAccessAllowed": true + }, + "fields": "importFunctionsExternalUrlAccessAllowed" + } + } + ] +} +``` + +After this change, the warning message will no longer appear, and the functions will work as expected!