Justify a script
Records why this script is allowed to run on a payment page, which is what PCI DSS 6.4.3 requires. The justification is tied to the script's current hash, so if its contents change later it goes back to needing review. Adds an entry to the script's history.
Requires the analyst role on the website and the compliance plan feature.
AuthorizationBearer <JWT>An OpenID Connect access token from signing in to CentralCSP, acting as the signed-in user.
workspaceId*stringThe workspace's id.
websiteId*stringThe website's id.
inventoryId*stringThe inventory script's id.
application/json- body
justification*stringWhy this script is allowed to run on a payment page. Assessors read this, so say what the script does and who approved it.
1 <= length <= 4096A script seen on a payment page.
application/json- response
id*stringwebsiteId*stringsubresourceUrl*stringURL of the script.
status*InventoryStatusunreviewed means nobody has looked at it yet. justified means it is authorized at its current hash. needs_review means it was justified but its contents have since changed. unauthorized means a person or a reject rule decided it does not belong on a payment page. excluded means an exclude rule took it out of PCI scope, for example a script a browser extension injects.
"unreviewed""justified""needs_review""unauthorized""excluded"justification*|Why the script is allowed to run, when it has been justified.
originId*|The inventory origin this script belongs to.
origin*|The origin serving the script.
tags*array<>Tags applied to this script, by hand or by a rule.
justifiedHash*|The hash the justification was given for.
currentHash*|The hash last reported by browsers. When it differs from justifiedHash the script needs review again.
ruleId*|The rule that decided this script, or null when a person did.
justifiedBy*|Identifier of the person who justified it, or null once their account is deleted.
justifiedByName*|Name of the person who justified it, kept after their account is deleted.
justifiedByEmail*|Email of the person who justified it.
justifiedByDeleted*booleantrue when the person who justified it can no longer be named.
justifiedAt*|When it was justified.
unauthorizedReason*|Why the script was judged not to belong.
unauthorizedBy*|Identifier of the person who marked it unauthorized, or null once their account is deleted.
unauthorizedByName*|Name of the person who marked it unauthorized, kept after their account is deleted.
unauthorizedByEmail*|Email of the person who marked it unauthorized.
unauthorizedByDeleted*booleantrue when the person who marked it unauthorized can no longer be named.
unauthorizedAt*|When it was marked unauthorized.
retiredAt*|When the script left the PCI scope, or null while it is still seen on a payment page. Retired scripts are listed only with includeRetired, and return automatically if the script reappears.
firstSeen*|When the script was first reported on a payment page.
lastSeen*|When it was last reported.
createdAt*stringdate-timeupdatedAt*stringdate-timecurl -X POST 'https://api.centralcsp.com/v1/workspaces/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/websites/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/compliance/scripts/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/justify' \ -H 'Content-Type: application/json' \ -d '{ "justification": "Stripe payment form, required for card entry. Approved by security review 2026-01-12."}'{ "id": "string", "websiteId": "string", "subresourceUrl": "https://js.stripe.com/v3/", "status": "unreviewed", "justification": "string", "originId": "string", "origin": "https://js.stripe.com", "tags": [ { "id": "string", "name": "string", "color": "slate" } ], "justifiedHash": "string", "currentHash": "string", "ruleId": "string", "justifiedBy": "string", "justifiedByName": "Dana Reed", "justifiedByEmail": "dana@example.com", "justifiedByDeleted": true, "justifiedAt": "2019-08-24T14:15:22Z", "unauthorizedReason": "string", "unauthorizedBy": "string", "unauthorizedByName": "Dana Reed", "unauthorizedByEmail": "dana@example.com", "unauthorizedByDeleted": true, "unauthorizedAt": "2019-08-24T14:15:22Z", "retiredAt": "2019-08-24T14:15:22Z", "firstSeen": "2019-08-24T14:15:22Z", "lastSeen": "2019-08-24T14:15:22Z", "createdAt": "2019-08-24T14:15:22Z", "updatedAt": "2019-08-24T14:15:22Z"}List a script's history GET
Returns the full history of one script, newest first: when it was first seen, every time its contents changed, and every decision made about it, with who made...
Mark a script unauthorized POST
Records that this script should not be running on a payment page, with the reason why.