# Script inventory (/en/docs/platform/features/pci-dss/script-inventory)





**PCI DSS** > **Script inventory** holds every script observed on a page matching a payment-page pattern that is turned on, each with a review status. It is the working queue for requirements 6.4.3 and 11.6.1.

<Callout type="info">
  PCI DSS monitoring requires a plan that includes compliance. Compare plans on the [pricing page](/pricing) or under **Settings** > **Billing**.
</Callout>

The scripts themselves come from the [script inventory](/en/docs/platform/features/script-inventory) CentralCSP builds from CSP hash reports. This page is that inventory narrowed to payment-page scope, with statuses, justifications, and an audit trail attached.

If the page is empty, the cause is almost always scope rather than reporting. For more information, refer to [Payment pages](/en/docs/platform/features/pci-dss/payment-pages).

## The four tabs [#the-four-tabs]

The inventory is split across four tabs:

| Tab                 | Shows                                                         |
| ------------------- | ------------------------------------------------------------- |
| **Origins**         | One row per origin serving scripts in scope                   |
| **Scripts**         | The full inventory, filterable by any status                  |
| **Action required** | Your work queue, holding only `Unreviewed` and `Needs review` |
| **Rejected**        | Only scripts marked rejected                                  |

Select an origin on the Origins tab to filter Scripts by it. Work from **Action required**. It is the only tab whose emptiness means something. Rules can shorten that queue before you reach it. For more information, refer to [Inventory rules](/en/docs/platform/features/pci-dss/justification-rules).

Retired scripts do not appear on any tab.

The Action required tab holds a mix of statuses:

<img alt="The script inventory on its Action required tab, with a mix of statuses" src="__img0" width="1359" height="645" />

## Review statuses [#review-statuses]

Every script in scope carries one status:

| Status           | Meaning                                       |
| ---------------- | --------------------------------------------- |
| **Unreviewed**   | Detected, nobody has decided                  |
| **Needs review** | Was justified, and the hash has changed since |
| **Justified**    | Authorized at its current hash                |
| **Rejected**     | Judged not to belong on a payment page        |

**Needs review** is the status that does the work in requirement 11.6.1. A justification is pinned to the hash it was made against. When content at that URL changes, the script comes back to you instead of staying quietly approved.

The evidence PDF prints these as Pending review, Hash changed, Authorized, and Rejected.

## What is recorded per script [#what-is-recorded-per-script]

Each script carries its origin, first and last seen, current hash, [tags](/en/docs/platform/features/pci-dss/tags), the current review decision, and the full history.

Two things there are worth knowing. **Pages** lists the document URLs it was seen on, which answers scope questions directly. **Hash history** lists every hash with first and last seen, which is how you tell a routine release cadence from an unexpected change.

Making decisions from here is covered in [Justifying scripts](/en/docs/platform/features/pci-dss/justifying-scripts).

## Refresh inventory [#refresh-inventory]

Managers get a **Refresh inventory** button, rate-limited to once per 30 seconds. For more information on roles, refer to [Access control](/en/docs/platform/websites/access-control). Reconciliation also runs hourly and immediately after any scope or rule change, so you rarely need it. For more information, refer to [Reconciliation](/en/docs/platform/features/pci-dss/reconcile).

## Export the script inventory to CSV [#export-the-script-inventory-to-csv]

The toolbar exports the current view, honouring your filters, with no row limit. It includes the justification text, both hashes, who decided and when, and the tags.

Use it to work through a large inventory in a spreadsheet, or to share one with someone who has no dashboard access. The **Viewer** role is enough.

For a full audit package including the ledger, use the [evidence export](/en/docs/platform/features/pci-dss/evidence-export) instead.

## Next steps [#next-steps]

* [Justifying scripts](/en/docs/platform/features/pci-dss/justifying-scripts)
* [Origins](/en/docs/platform/features/pci-dss/origins)
* [Script inventory](/en/docs/platform/features/script-inventory)