Everything the add-on does, in plain terms.
Four things happen in an import: you point at data, you decide its shape, you write it somewhere, and you keep it fresh. This page covers each, plus what is deliberately not built yet.
Point at the data
Six ways in. Four of them never touch our servers.
Paste or read from a cell
Drop a payload into the sidebar or point at a cell that already holds one. Parsed locally, no account needed.
Public URL
A GET with no credentials, from the sidebar or straight from a JSON_IMPORT() formula.
Full request builder
GET, POST, PUT, PATCH, DELETE with query parameters, custom headers, and JSON or form bodies.
Paste a cURL command
URL, method, headers, query, basic auth, and body are extracted into the builder. Unsafe flags are refused, never executed.
Request variables bound to cells
Named placeholders resolved at run time from the cells you choose, in the URL, query, path, headers, or body.
Range to JSON
Select a table with headers and get an array of objects, an object, or row arrays back. Local and unmetered.
Decide the shape
The part other importers guess at. You see the table before it is written.
Visual explorer
A searchable, collapsible tree with type badges and array counts. Tick fields, pick a root array, and paths are generated for you. Large schemas render without loading the whole payload.
Exact output preview
The real headers, representative cell values, and predicted row and column counts — with a warning when a mode will multiply parent records.
Three query languages
Simple dot paths for beginners, a documented JSONPath subset, and JMESPath for filtering and reshaping. The sidebar always labels which one is active.
Deterministic flattening
Nested keys become dot-notation columns in a stable order. Source keys that already contain dots or brackets are escaped rather than silently merged.
Three nested-array modes
rows repeats the parent, join collapses to one cell, json keeps the array intact.
Types that survive the trip
Booleans stay booleans, nulls stay blank, integers beyond safe range stay text, and numeric or date-looking strings are only converted if you ask.
Write it safely
An import should never be the reason you reach for version history.
Managed output ranges
Each import remembers the range it owns and refreshes only that. Touching data outside it needs your confirmation, and no run clears a whole worksheet.
Overwrite, append, upsert
Update-or-append matches on one unique key, updates managed columns, appends new keys, and never deletes rows that are missing from the latest response.
Honest row accounting
Every run reports inserted, updated, unchanged, and rejected counts. Blank or duplicate keys are refused with an explanation instead of a silent winner.
Formula-injection protection
Remote text starting with =, +, -, or @ is escaped by default so a payload cannot execute in your sheet.
Destination choice
The selected cell, the active sheet, or a fresh sheet. Written in batches, not cell by cell.
Limits before damage
Row and column caps are enforced before anything is written, so an unexpectedly huge response fails cleanly.
Keep it running
Saved requests, schedules, caching, and enough visibility to debug a bad response.
Saved requests
Name it, run it, duplicate it, edit it, see its last run. Stored against your account with a reference to a connection — never a plaintext secret.
Scheduled refresh
Daily on Starter, hourly on Pro, via a spreadsheet trigger you authorise. Entitlements are rechecked on every run and orphaned schedules are disabled.
Cache you control
Set a TTL, bypass it on demand, and see whether a run was served from cache. Cache hits never consume a request.
Request debugger
The sanitised request as sent, upstream status, duration, pages, bytes, and cache state — with secrets redacted and a debug ID to quote at support.
Errors that say what to do
No bare #ERROR! and no stack traces.
Usage in view
A meter in the sidebar, warnings at 70%, 90%, and 100%, and the exact reset timestamp. See the plans →
Credentials
Your API tokens are the most dangerous thing in a spreadsheet. They do not live in one.
Five connection types
Bearer token, API key in a header, API key in a query parameter, basic auth, and a custom secret header set.
Encrypted at rest
AES-256-GCM with key versioning and a unique nonce per operation. No plaintext column exists.
Write-only
A secret is never returned after saving. You see a mask, and you can rename, test, rotate, or revoke.
Never in a formula
Formula arguments cannot carry secrets, so a shared spreadsheet cannot leak yours.
URL safety checks
Every fetch resolves DNS first and refuses private, loopback, link-local, and cloud-metadata addresses — revalidated after each redirect.
Minimal Google scopes
Current spreadsheet only. No Drive access, no mail, no directory. Details →
Not built yet — on purpose
If it is on this list, it does not work today. We would rather ship a smaller product that does what it says. Follow the changelog →
See the formula surface next.
Thirteen functions, twelve of them local and unmetered.