> This page is for Applications Protection. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.humansecurity.com/llms.txt. # Get script inventory GET https://api-gw.perimeterx.com/v1/pci/inventory/scripts Returns a list of PCI DSS payment page script inventory for the given Application ID and host domain. Scripts must exceed HUMAN's internal appearance threshold before they are introduced into the system and appear in the response. This prevents testing and low volume data from interfering with data quality. Reference: https://docs.humansecurity.com/applications/reference/get-script-inventory ## Authentication - `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer `, where token is your auth token. ## Request ### Query parameters - `appId` (list of string, required) — An array of Application IDs to filter the relevant scripts by. At least one ID is required. - `tld` (list of string, required) — An array of host domains to filter the relevant scripts by. At least one domain is required. - `excludedStatuses` (list of enum, optional) — An array of script statuses that should be excluded from the results. - Allowed values: `authorized`, `in_progress`, `unreviewed` - `from` (integer, optional) — A timestamp, in milliseconds, indicating from what point in time to filter the results by. If omitted, defaults to the **later** time between the following: 1. The last time [script grouping](/applications/cd-glossary#grouping) was performed plus one hour. 2. One year ago. Further, if a value is provided and it is **earlier** than the default calculated by the above logic, then the default will be used instead. - `to` (integer, optional) — A timestamp, in milliseconds, indicating until what point in time to filter the results by. Defaults to the current time. - `skip` (integer, optional, default: 0) — The number of scripts to offset pagination by when returning the results. - `take` (integer, optional, default: 20) — The number of scripts to display per page when returning the results. - `include` (list of enum, optional) — Controls which **extra** fields are computed and returned on each script in the inventory response. Omitting `include` (or sending an empty list) keeps the response smaller by not loading cookie connections, value access, external domains, or user exposure metrics unless requested. - Allowed values: `cookies`, `value_access`, `domains`, `users_exposed` ## Response ### 200 Success - `paging` (GetScriptInventoryPaging, optional) - `data` (list of GetScriptInventoryDataItems, optional) ## Errors ### 401 Unauthorized Error Access token is missing or invalid. - `any` ### 422 Unprocessable Entity Error Invalid or missing parameters. - `any` ### 500 Internal Server Error Internal error. Contact HUMAN if the error persists. - `any` ## Types ### GetScriptInventoryPaging - `previous` (string, optional) - `current` (string, optional) - `next` (string, optional) - `count` (integer, optional) ### GetScriptInventoryDataItems - `key` (string, optional) — The script's key - `script_url` (string, optional) - `app_id` (string, optional) - `host_domain` (string, optional) - `type` (string, optional) - `vendor` (string, optional) - `first_seen` (string, optional) - `last_seen` (string, optional) - `risk` (GetScriptInventoryDataItemsRisk, optional) — Pairs of risk levels and reasons for the assigned level. - `page_types` (list of any, optional) - `status` (string, optional) - `status_category` (string, optional) - `justification` (string, optional) — The justification note for the script. - `pages` (list of any, optional) — An array of page URLs where the script was found. ### GetScriptInventoryDataItemsRisk Pairs of risk levels and reasons for the assigned level. - `level` (string, optional) - `reason` (string, optional) ## Examples **Response** ```json { "paging": { "previous": "", "current": "https://localhost:80/v1/pci/inventory/scripts?appId=PXabcd1234&tld=humansecurity.com&take=1&skip=0", "next": "https://localhost:80/v1/pci/inventory/scripts?appId=PXabcd1234&tld=humansecurity.com&take=1&skip=1", "count": 31 }, "data": [ { "key": "aaa111bbb222ccc333ddd444", "script_url": "cdn.mxpnl.com/libs/mixpanel-2-latest.min.js", "app_id": "PXabcd1234", "host_domain": "humansecurity.com", "type": "third_party", "vendor": "MixPanel", "first_seen": "2023-10-19T00:00:00Z", "last_seen": "2024-08-29T06:00:12Z", "risk": { "level": "high", "reason": "Credit card access is being made by a third party script" }, "page_types": [ "string" ], "status": "unreviewed", "status_category": "unreviewed", "justification": "string", "pages": [ "string" ] } ] } ``` **SDK Code** ```python import requests url = "https://api-gw.perimeterx.com/v1/pci/inventory/scripts" querystring = {"appId":"[\"PXabc123\",\"PXdef456\"]","excludedStatuses":"[\"authorized\",\"in_progress\"]","from":"1674313200000","include":"[\"cookies\",\"domains\"]","skip":"40","take":"10","tld":"[\"domain1.com\",\"domain2.com\"]","to":"1674313200000"} headers = {"Authorization": "Bearer "} response = requests.get(url, headers=headers, params=querystring) print(response.json()) ``` ```javascript const url = 'https://api-gw.perimeterx.com/v1/pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&excludedStatuses=%5B%22authorized%22%2C%22in_progress%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22domains%22%5D&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "net/http" "io" ) func main() { url := "https://api-gw.perimeterx.com/v1/pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&excludedStatuses=%5B%22authorized%22%2C%22in_progress%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22domains%22%5D&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("Authorization", "Bearer ") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://api-gw.perimeterx.com/v1/pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&excludedStatuses=%5B%22authorized%22%2C%22in_progress%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22domains%22%5D&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Get.new(url) request["Authorization"] = 'Bearer ' response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.get("https://api-gw.perimeterx.com/v1/pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&excludedStatuses=%5B%22authorized%22%2C%22in_progress%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22domains%22%5D&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000") .header("Authorization", "Bearer ") .asString(); ``` ```php request('GET', 'https://api-gw.perimeterx.com/v1/pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&excludedStatuses=%5B%22authorized%22%2C%22in_progress%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22domains%22%5D&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000', [ 'headers' => [ 'Authorization' => 'Bearer ', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://api-gw.perimeterx.com/v1/pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&excludedStatuses=%5B%22authorized%22%2C%22in_progress%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22domains%22%5D&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000"); var request = new RestRequest(Method.GET); request.AddHeader("Authorization", "Bearer "); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = ["Authorization": "Bearer "] let request = NSMutableURLRequest(url: NSURL(string: "https://api-gw.perimeterx.com/v1/pci/inventory/scripts?appId=%5B%22PXabc123%22%2C%22PXdef456%22%5D&excludedStatuses=%5B%22authorized%22%2C%22in_progress%22%5D&from=1674313200000&include=%5B%22cookies%22%2C%22domains%22%5D&skip=40&take=10&tld=%5B%22domain1.com%22%2C%22domain2.com%22%5D&to=1674313200000")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```