CentralCSP
APIInventory Scripts

List inventory scripts

Lists every script seen on this website's payment pages, with its review status, justification, current hash, origin, and tags. This is the inventory PCI DSS 6.4.3 asks you to keep. Scripts are added automatically from the reports your website sends and cannot be created through the API. Use requiresAction to list only the scripts that still need a decision. The most recently seen script comes first.

Requires the viewer role on the website and the compliance plan feature.

GET
/v1/workspaces/{workspaceId}/websites/{websiteId}/compliance/scripts

Authorization

headerAuthorizationBearer <JWT>

An OpenID Connect access token from signing in to CentralCSP, acting as the signed-in user.

Path Parameters

workspaceId*string

The workspace's id.

websiteId*string

The website's id.

Query Parameters

cursor?string

The nextCursor of the previous page. Omit it to start from the beginning. A cursor encodes a position and is not meant to be built by hand.

limit*|

How many items to return, from 1 to 200.

Range1 <= value <= 200
Default50
status?InventoryStatus

unreviewed means nobody has looked at it yet. justified means it is authorized at its current hash. needs_review means it was justified but its contents have since changed. unauthorized means a person or a reject rule decided it does not belong on a payment page. excluded means an exclude rule took it out of PCI scope, for example a script a browser extension injects.

Value in"unreviewed""justified""needs_review""unauthorized""excluded"
requiresAction?boolean

true returns only scripts still waiting for a decision.

search?string

Match part of the script URL.

Lengthlength <= 255
originId?string

Only scripts served by this origin.

Lengthlength <= 36
tagIds?string

Comma-separated tag identifiers. A script matches if it carries any of them.

Lengthlength <= 2048
includeRetired?boolean

Also return scripts that have left the PCI scope. Defaults to false.

Response Body

A page of inventory scripts.

application/json
  1. response
data*array<>

The inventory scripts on this page.

pagination*

Where this page sits in the full result set.

Example Request
curl -X GET 'https://api.centralcsp.com/v1/workspaces/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/websites/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/compliance/scripts?limit=50'
Example Response
{  "data": [    {      "id": "string",      "websiteId": "string",      "subresourceUrl": "https://js.stripe.com/v3/",      "status": "unreviewed",      "justification": "string",      "originId": "string",      "origin": "https://js.stripe.com",      "tags": [        {          "id": "string",          "name": "string",          "color": "slate"        }      ],      "justifiedHash": "string",      "currentHash": "string",      "ruleId": "string",      "justifiedBy": "string",      "justifiedByName": "Dana Reed",      "justifiedByEmail": "dana@example.com",      "justifiedByDeleted": true,      "justifiedAt": "2019-08-24T14:15:22Z",      "unauthorizedReason": "string",      "unauthorizedBy": "string",      "unauthorizedByName": "Dana Reed",      "unauthorizedByEmail": "dana@example.com",      "unauthorizedByDeleted": true,      "unauthorizedAt": "2019-08-24T14:15:22Z",      "retiredAt": "2019-08-24T14:15:22Z",      "firstSeen": "2019-08-24T14:15:22Z",      "lastSeen": "2019-08-24T14:15:22Z",      "createdAt": "2019-08-24T14:15:22Z",      "updatedAt": "2019-08-24T14:15:22Z"    }  ],  "pagination": {    "nextCursor": "string",    "hasMore": true,    "total": 0  }}

Export the script inventory GET

Downloads the whole inventory as CSV, with the same filters as the list endpoint and no pagination. Suitable as evidence for an assessor.

Get an inventory script GET

Returns one script of the inventory with its review status, justification, current hash, origin and tags, as the list shows it.