> This page is for Applications Protection. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.humansecurity.com/llms.txt. # Get non-PCI script inventory GET https://api-gw.perimeterx.com/v1/non-pci/inventory/scripts Returns a flat list of non-PCI script observations for the given Application IDs and host domains. Each row represents one unique combination of script, page, and access type (cookie read or form field access). Unlike the [PCI DSS script inventory](/applications/reference/get-script-inventory), this endpoint returns raw behavioral observations rather than aggregated, compliance-reviewed scripts. The response does not include status, risk, or justification fields. Observations from scripts that have been deactivated or suppressed are excluded from results. The `include` parameter is functionally required. If `include` is omitted or empty, the endpoint returns an empty `data` array. Reference: https://docs.humansecurity.com/applications/reference/get-non-pci-script-inventory ## Authentication - `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer `, where token is your auth token. ## Request ### Query parameters - `appId` (list of string, required) — One or more Application IDs to filter results by. - `tld` (list of string, required) — One or more host domains to filter results by. - `include` (list of enum, required) — Controls which observation types are returned. Must include at least one value. Accepted values: `cookies`, `value_access`. - Allowed values: `cookies`, `value_access` - `from` (integer, optional) — Timestamp in milliseconds. Start of the time range to filter observations by. Defaults to 24 hours ago. - `to` (integer, optional) — Timestamp in milliseconds. End of the time range to filter observations by. Defaults to the current time. - `skip` (integer, optional, default: 0) — Number of results to skip for pagination. - `take` (integer, optional, default: 20) — Number of results to return per page. ## Response ### 200 Success - `paging` (GetNonPciScriptInventoryPaging, optional) - `data` (list of GetNonPciScriptInventoryDataItems, optional) ## Errors ### 401 Unauthorized Error Access token is missing or invalid. - `any` ### 422 Unprocessable Entity Error Invalid or missing parameters. - `any` ### 500 Internal Server Error Internal error. Contact HUMAN if the error persists. - `any` ## Types ### GetNonPciScriptInventoryPaging - `previous` (string, optional) - `current` (string, optional) - `next` (string, optional) - `count` (integer, optional) ### GetNonPciScriptInventoryDataItems - `app_id` (string, optional) — The Application ID the observation belongs to. - `account_name` (string, optional) — The account name associated with the application. - `host_domain` (string, optional) — The host domain where the script was observed. - `page_url` (string, optional) — The specific page URL where the observation occurred. - `page_type` (string, optional) — The type of page. - `script_url` (string, optional) — The URL of the script. Returns `All Inline Scripts` for inline scripts. - `access_type` (enum, optional) — What the script accessed. - Allowed values: `cookie`, `value_access` - `cookie_name` (string, optional) — Name of the cookie accessed. Populated when `access_type` is `cookie`. - `input_element_name` (string, optional) — Name attribute of the form field accessed. Populated when `access_type` is `value_access`. - `input_element_id` (string, optional) — ID attribute of the form field accessed. Populated when `access_type` is `value_access`. ## Examples **Response** ```json { "paging": { "previous": "", "current": "https://api-gw.perimeterx.com/v1/non-pci/inventory/scripts?appId=PXabc1234&tld=humansecurity.com&include=cookies&include=value_access&take=20&skip=0", "next": "https://api-gw.perimeterx.com/v1/non-pci/inventory/scripts?appId=PXabc1234&tld=humansecurity.com&include=cookies&include=value_access&take=20&skip=20", "count": 142 }, "data": [ { "app_id": "PXabc1234", "account_name": "HUMAN Security", "host_domain": "humansecurity.com", "page_url": "https://humansecurity.com/checkout.html", "page_type": "checkout", "script_url": "cdn.mxpnl.com/libs/mixpanel-2-latest.min.js", "access_type": "cookie", "cookie_name": "_ga", "input_element_name": "email", "input_element_id": "email-input" } ] } ``` **SDK Code** ```python import requests url = "https://api-gw.perimeterx.com/v1/non-pci/inventory/scripts" querystring = {"appId":"[\"PXabc123\",\"PXdef456\"]","from":"1674313200000","include":"[\"cookies\",\"value_access\"]","skip":"0","take":"20","tld":"[\"domain1.com\",\"domain2.com\"]","to":"1674399600000"} headers = {"Authorization": "Bearer "} response = requests.get(url, headers=headers, params=querystring) print(response.json()) ``` ```javascript const url = 'https://api-gw.perimeterx.com/v1/non-pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22value_access%22%5D&skip=0&take=20&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674399600000'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "net/http" "io" ) func main() { url := "https://api-gw.perimeterx.com/v1/non-pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22value_access%22%5D&skip=0&take=20&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674399600000" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("Authorization", "Bearer ") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://api-gw.perimeterx.com/v1/non-pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22value_access%22%5D&skip=0&take=20&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674399600000") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Get.new(url) request["Authorization"] = 'Bearer ' response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.get("https://api-gw.perimeterx.com/v1/non-pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22value_access%22%5D&skip=0&take=20&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674399600000") .header("Authorization", "Bearer ") .asString(); ``` ```php request('GET', 'https://api-gw.perimeterx.com/v1/non-pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22value_access%22%5D&skip=0&take=20&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674399600000', [ 'headers' => [ 'Authorization' => 'Bearer ', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://api-gw.perimeterx.com/v1/non-pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22value_access%22%5D&skip=0&take=20&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674399600000"); var request = new RestRequest(Method.GET); request.AddHeader("Authorization", "Bearer "); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = ["Authorization": "Bearer "] let request = NSMutableURLRequest(url: NSURL(string: "https://api-gw.perimeterx.com/v1/non-pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22value_access%22%5D&skip=0&take=20&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674399600000")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```