# REST API

> Manage teams, domains and payment pages from your backend with the Script Monitoring REST API: base URL, API keys and scopes, rate limit, paging and errors.

Source: https://docs.scriptmonitoring.com/api/ · Plan: All plans · Updated 2026-10-13

The Script Monitoring REST API lets your backend create and delete teams, register and remove domains, and add payment pages, with an API key from **Developers > API keys**. It is a JSON API at `https://data.scriptmonitoring.com/v1/`, limited to 60 requests per minute per organization. The full OpenAPI document is at [data.scriptmonitoring.com/docs](https://data.scriptmonitoring.com/docs).

## How do I authenticate?

Send your API key as a Bearer token in the `Authorization` header:

```http
Authorization: Bearer sm_org_14829305716342_…
```

```shell
curl https://data.scriptmonitoring.com/v1/domains/ \
  -H "Authorization: Bearer $SCRIPT_MONITORING_API_KEY"
```

Create keys under **Developers > API keys**. A key is shown once, so store it in your secrets manager and use it only from your backend. The examples read it from `SCRIPT_MONITORING_API_KEY`.

| Key | Who can create it | What it can do |
| --- | --- | --- |
| Organization key, `sm_org_…` | Super admins | Any scope below, for every team in the organization. Pass `team_id` where an endpoint asks for it. |
| Team key, `sm_team_…` | Super admins and Admins of the team | The domain and payment page scopes, for its own team only. |

After the prefix comes a 14-digit key ID, then an underscore and the secret: `sm_team_10937462815530_…`. See [What does a key look like?](https://docs.scriptmonitoring.com/api-keys/#what-does-a-key-look-like).

> **Example IDs are not real** The IDs in these examples, such as team `14827391650423` and organization `org_11938475026617`, are reserved for documentation. They never belong to a live customer, and requests with them fail. Replace `YOUR_TEAM_ID` with your own team ID from the **Team ID** chip in the dashboard's top bar.

## Which key does each endpoint accept?

| Endpoint | Organization key | Team key |
| --- | --- | --- |
| [List teams](https://docs.scriptmonitoring.com/api/teams/list/) | Yes | No: `401` |
| [Create a team](https://docs.scriptmonitoring.com/api/teams/create/) | Yes, Pro and Enterprise | No: `401` |
| [Delete a team](https://docs.scriptmonitoring.com/api/teams/delete/) | Yes | No: `401` |
| [List domains](https://docs.scriptmonitoring.com/api/domains/list/) | Yes, any team in the organization | Yes, its own team. Another team's `team_id` gets `404 team_not_found`. |
| [Register domains](https://docs.scriptmonitoring.com/api/domains/create/) | Yes, with `team_id` | Yes, its own team |
| [Delete domains](https://docs.scriptmonitoring.com/api/domains/delete/) | Yes, with `team_id` | Yes, its own team |
| [Add a payment page](https://docs.scriptmonitoring.com/api/payment-pages/create/) | Yes, with `team_id` | Yes, its own team. Another team's `team_id` gets `401`. |

## What does a 401 mean?

Every endpoint answers `401` with the same body when the key can't be used:

```json
{ "error": "unauthorized", "message": "Missing or invalid bearer token." }
```

That covers a missing `Authorization` header, a mistyped or revoked key, a key whose prefix doesn't match its type (an organization key sent as `sm_team_…`, or the reverse), a key in a format created before `sm_org_` and `sm_team_` (those were revoked when the format changed), and a team key on the teams endpoints. A revoked key and one that never existed get the same answer. Create a new key under **Developers > API keys**.

A key carries only the scopes you pick when you create it:

| Scope | Label in the dashboard | Allows |
| --- | --- | --- |
| `teams:create` | Create teams | `POST /v1/teams` |
| `teams:delete` | Delete teams | `DELETE /v1/teams` |
| `teams:read` | List teams | `GET /v1/teams` |
| `domains:create` | Register domains | `POST /v1/domains` |
| `domains:delete` | Delete domains | `DELETE /v1/domains` |
| `domains:read` | List domains | `GET /v1/domains` |
| `payment_pages:create` | Add payment pages | `POST /v1/payment-pages` |

A create or delete scope also allows looking up a single record (`?name=` or `?domain=`); listing everything needs the read scope.

## What are the limits?

60 requests per minute per organization, shared by every key and endpoint. Over the limit the API answers `429` with `{"error":"rate_limited"}`.

## How does paging work?

List endpoints take `limit` (1 to 100, default 50) and `cursor`, and return `next_cursor`. Pass it back as `cursor` for the next page; it is `null` on the last page.

## What do errors look like?

Every error has the same body:

```json
{ "error": "insufficient_scope", "message": "..." }
```

| Status | Common `error` values |
| --- | --- |
| 400 | `invalid_request`, `invalid_cursor` |
| 401 | `unauthorized`: missing, invalid or revoked key, or a team key on a teams endpoint |
| 402 | `upgrade_required` |
| 403 | `insufficient_scope`, `organization_suspended`, `team_suspended` |
| 404 | `team_not_found` |
| 409 | `team_name_exists`, `team_subscription_attached` |
| 429 | `rate_limited` |
| 503 | `rate_limit_unavailable` and endpoint-specific `*_unavailable` errors: retry later |

## Frequently asked questions

### Which plans include the REST API?

Every plan. Creating teams with the API needs Pro or Enterprise; on Free, `POST /v1/teams` answers 402 `upgrade_required`.

### Is the dashboard's GraphQL API supported?

No. The GraphQL API is the dashboard's own and is not a public interface. API keys do not authenticate it.

### Do keys expire?

No. A key works until you revoke it under **Developers > API keys**. Revoking all of an organization's keys at once is also possible there.

### Why does my key get 401 unauthorized?

The key is missing, mistyped, revoked, or in a format that is no longer accepted. Only keys starting with `sm_org_` or `sm_team_` work; older keys were revoked when the format changed. A team key also gets 401 on the teams endpoints. Create a new key under **Developers > API keys**.

## Related

- [Register domains](https://docs.scriptmonitoring.com/api/domains/create/)
- [Webhooks](https://docs.scriptmonitoring.com/webhooks/)