REST APIOverview
Payment pages
Events
- HOOKWebhooks
- S3 exportSoon
Manage teams, domains and payment pages from your backend with the Script Monitoring REST API: base URL, API keys and scopes, rate limit, paging and errors.
The Script Monitoring REST API lets your backend create and delete teams, register and remove domains, and add payment pages, with an API key from Developers > API keys. It is a JSON API at https://data.scriptmonitoring.com/v1/, limited to 60 requests per minute per organization. The full OpenAPI document is at data.scriptmonitoring.com/docs.
How do I authenticate?#
Send your API key as a Bearer token in the Authorization header:
Authorization: Bearer sm_org_14829305716342_…
curl https://data.scriptmonitoring.com/v1/domains/ \
-H "Authorization: Bearer $SCRIPT_MONITORING_API_KEY"
Create keys under Developers > API keys. A key is shown once, so store it in your secrets manager and use it only from your backend. The examples read it from SCRIPT_MONITORING_API_KEY.
| Key | Who can create it | What it can do |
|---|---|---|
Organization key, sm_org_… | Super admins | Any scope below, for every team in the organization. Pass team_id where an endpoint asks for it. |
Team key, sm_team_… | Super admins and Admins of the team | The domain and payment page scopes, for its own team only. |
After the prefix comes a 14-digit key ID, then an underscore and the secret: sm_team_10937462815530_…. See What does a key look like?.
The IDs in these examples, such as team 14827391650423 and organization org_11938475026617, are reserved for documentation. They never belong to a live customer, and requests with them fail. Replace YOUR_TEAM_ID with your own team ID from the Team ID chip in the dashboard's top bar.
Which key does each endpoint accept?#
| Endpoint | Organization key | Team key |
|---|---|---|
| List teams | Yes | No: 401 |
| Create a team | Yes, Pro and Enterprise | No: 401 |
| Delete a team | Yes | No: 401 |
| List domains | Yes, any team in the organization | Yes, its own team. Another team's team_id gets 404 team_not_found. |
| Register domains | Yes, with team_id | Yes, its own team |
| Delete domains | Yes, with team_id | Yes, its own team |
| Add a payment page | Yes, with team_id | Yes, its own team. Another team's team_id gets 401. |
What does a 401 mean?#
Every endpoint answers 401 with the same body when the key can't be used:
{ "error": "unauthorized", "message": "Missing or invalid bearer token." }
That covers a missing Authorization header, a mistyped or revoked key, a key whose prefix doesn't match its type (an organization key sent as sm_team_…, or the reverse), a key in a format created before sm_org_ and sm_team_ (those were revoked when the format changed), and a team key on the teams endpoints. A revoked key and one that never existed get the same answer. Create a new key under Developers > API keys.
A key carries only the scopes you pick when you create it:
| Scope | Label in the dashboard | Allows |
|---|---|---|
teams:create | Create teams | POST /v1/teams |
teams:delete | Delete teams | DELETE /v1/teams |
teams:read | List teams | GET /v1/teams |
domains:create | Register domains | POST /v1/domains |
domains:delete | Delete domains | DELETE /v1/domains |
domains:read | List domains | GET /v1/domains |
payment_pages:create | Add payment pages | POST /v1/payment-pages |
A create or delete scope also allows looking up a single record (?name= or ?domain=); listing everything needs the read scope.
What are the limits?#
60 requests per minute per organization, shared by every key and endpoint. Over the limit the API answers 429 with {"error":"rate_limited"}.
How does paging work?#
List endpoints take limit (1 to 100, default 50) and cursor, and return next_cursor. Pass it back as cursor for the next page; it is null on the last page.
What do errors look like?#
Every error has the same body:
{ "error": "insufficient_scope", "message": "..." }
| Status | Common error values |
|---|---|
| 400 | invalid_request, invalid_cursor |
| 401 | unauthorized: missing, invalid or revoked key, or a team key on a teams endpoint |
| 402 | upgrade_required |
| 403 | insufficient_scope, organization_suspended, team_suspended |
| 404 | team_not_found |
| 409 | team_name_exists, team_subscription_attached |
| 429 | rate_limited |
| 503 | rate_limit_unavailable and endpoint-specific *_unavailable errors: retry later |
Frequently asked questions#
Which plans include the REST API?
Every plan. Creating teams with the API needs Pro or Enterprise; on Free, POST /v1/teams answers 402 upgrade_required.
Is the dashboard's GraphQL API supported?
No. The GraphQL API is the dashboard's own and is not a public interface. API keys do not authenticate it.
Do keys expire?
No. A key works until you revoke it under Developers > API keys. Revoking all of an organization's keys at once is also possible there.
Why does my key get 401 unauthorized?
The key is missing, mistyped, revoked, or in a format that is no longer accepted. Only keys starting with sm_org_ or sm_team_ work; older keys were revoked when the format changed. A team key also gets 401 on the teams endpoints. Create a new key under Developers > API keys.