Depot scripts

Registers the library CRUD + lifecycle routes.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/scripts

GETscript:readshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List scripts

Parameters

Name	In	Type	Required	Description
agentId	query	string	No
category	query	string	No
dir	query	string, one of asc, desc	No	Sort direction.
osFamily	query	string	No
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
q	query	string	No
query	query	string	No
scope	query	string	No
sort	query	string, one of category, created, name, status, updated	No	Sort key.
status	query	string	No

Responses

Status	Body	Description
200	application/json, PagedResultScriptSummaryView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold script:read.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	The script library is not available on this Depot.

200 response body

Field	Type	Description
itemsrequired	array of ScriptSummaryView
items[].builtInrequired	boolean
items[].categoryrequired	string
items[].descriptionrequired	string
items[].interpreterrequired	string
items[].isCollectorrequired	boolean
items[].namerequired	string
items[].osFamilyrequired	string, one of any, linux, macos, windows
items[].publicIdrequired	string
items[].scoperequired	string
items[].statusrequired	string
items[].tagsrequired	array of string
items[].updatedAtrequired	string (date-time)
items[].versionrequired	integer
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/scripts?agentId=<agentId>&category=<category>&dir=asc&osFamily=<osFamily>&page=0&pageSize=0' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/scripts?agentId=<agentId>&category=<category>&dir=asc&osFamily=<osFamily>&page=0&pageSize=0' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/scripts"
params = {
    "agentId": "<agentId>",
    "category": "<category>",
    "dir": "asc",
    "osFamily": "<osFamily>",
    "page": "0",
    "pageSize": "0",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/scripts?agentId=<agentId>&category=<category>&dir=asc&osFamily=<osFamily>&page=0&pageSize=0", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/scripts");
url.searchParams.set("agentId", "<agentId>");
url.searchParams.set("category", "<category>");
url.searchParams.set("dir", "asc");
url.searchParams.set("osFamily", "<osFamily>");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/scripts?agentId=<agentId>&category=<category>&dir=asc&osFamily=<osFamily>&page=0&pageSize=0");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/scripts

POSTscript:manageshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Create script

Request body

Required, sent as application/json.

Field	Type	Description
body	string or null
category	string or null
collectorFieldKey	string or null
collectorParseMode	string or null
description	string or null
interpreter	string or null
isCollector	boolean or null
maxOutputBytes	integer or null	int64.
name	string or null
osFamily	string or null
paramsrequired	array of ScriptParamView
params[].defaultrequired	string
params[].descriptionrequired	string
params[].keyrequired	string
params[].kindrequired	string
params[].labelrequired	string
params[].optionsrequired	array of string
params[].requiredrequired	boolean
runAsDefault	string or null
scope	string or null
tagsrequired	array of string
timeoutSeconds	integer or null

Responses

Status	Body	Description
201	application/json, ScriptDetailView	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	This script is in the shared library, which every workspace on this Depot reads, and it is not edited from inside one of them. Duplicate it and change your own copy instead.
404	application/problem+json, ProblemDetails	No resource matches.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	The script library is not available on this Depot.

201 response body

Field	Type	Description
approvalCleared	boolean
approvalFloorFrameworks	array of string
approvalReason	string
approvalTicket	string
approvedAt	string (date-time) or null
approvedBy	string
approvedByName	string
approvedVia	string
bodyrequired	string
bodySha256required	string
builtInrequired	boolean
categoryrequired	string
collectorFieldKeyrequired	string
collectorParseModerequired	string
descriptionrequired	string
interpreterrequired	string
isCollectorrequired	boolean
maxOutputBytesrequired	integer	int64.
namerequired	string
osFamilyrequired	string, one of any, linux, macos, windows
ownWork	boolean
paramsrequired	array of ScriptParamView
params[].defaultrequired	string
params[].descriptionrequired	string
params[].keyrequired	string
params[].kindrequired	string
params[].labelrequired	string
params[].optionsrequired	array of string
params[].requiredrequired	boolean
publicIdrequired	string
runAsDefaultrequired	string
scoperequired	string
secondPersonApprovedrequired	boolean
soleEditor	boolean
statusrequired	string
tagsrequired	array of string
timeoutSecondsrequired	integer
updatedAtrequired	string (date-time)
versionrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/scripts' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "body": "string",
  "category": "string",
  "collectorFieldKey": "string",
  "collectorParseMode": "string",
  "description": "string",
  "interpreter": "string",
  "isCollector": false,
  "maxOutputBytes": 0,
  "name": "string",
  "osFamily": "string",
  "params": [
    {
      "default": "string",
      "description": "string",
      "key": "string",
      "kind": "string",
      "label": "string",
      "options": [
        "string"
      ],
      "required": false
    }
  ],
  "runAsDefault": "string",
  "scope": "string",
  "tags": [
    "string"
  ],
  "timeoutSeconds": 0
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "body": "string",
  "category": "string",
  "collectorFieldKey": "string",
  "collectorParseMode": "string",
  "description": "string",
  "interpreter": "string",
  "isCollector": false,
  "maxOutputBytes": 0,
  "name": "string",
  "osFamily": "string",
  "params": [
    {
      "default": "string",
      "description": "string",
      "key": "string",
      "kind": "string",
      "label": "string",
      "options": [
        "string"
      ],
      "required": false
    }
  ],
  "runAsDefault": "string",
  "scope": "string",
  "tags": [
    "string"
  ],
  "timeoutSeconds": 0
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/scripts' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/scripts"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "body": "string",
    "category": "string",
    "collectorFieldKey": "string",
    "collectorParseMode": "string",
    "description": "string",
    "interpreter": "string",
    "isCollector": False,
    "maxOutputBytes": 0,
    "name": "string",
    "osFamily": "string",
    "params": [
        {
            "default": "string",
            "description": "string",
            "key": "string",
            "kind": "string",
            "label": "string",
            "options": [
                "string",
            ],
            "required": False,
        },
    ],
    "runAsDefault": "string",
    "scope": "string",
    "tags": [
        "string",
    ],
    "timeoutSeconds": 0,
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "body": "string",
  "category": "string",
  "collectorFieldKey": "string",
  "collectorParseMode": "string",
  "description": "string",
  "interpreter": "string",
  "isCollector": false,
  "maxOutputBytes": 0,
  "name": "string",
  "osFamily": "string",
  "params": [
    {
      "default": "string",
      "description": "string",
      "key": "string",
      "kind": "string",
      "label": "string",
      "options": [
        "string"
      ],
      "required": false
    }
  ],
  "runAsDefault": "string",
  "scope": "string",
  "tags": [
    "string"
  ],
  "timeoutSeconds": 0
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/scripts", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/scripts";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "body": "string",
    "category": "string",
    "collectorFieldKey": "string",
    "collectorParseMode": "string",
    "description": "string",
    "interpreter": "string",
    "isCollector": false,
    "maxOutputBytes": 0,
    "name": "string",
    "osFamily": "string",
    "params": [
      {
        "default": "string",
        "description": "string",
        "key": "string",
        "kind": "string",
        "label": "string",
        "options": [
          "string"
        ],
        "required": false
      }
    ],
    "runAsDefault": "string",
    "scope": "string",
    "tags": [
      "string"
    ],
    "timeoutSeconds": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "body": "string",
  "category": "string",
  "collectorFieldKey": "string",
  "collectorParseMode": "string",
  "description": "string",
  "interpreter": "string",
  "isCollector": false,
  "maxOutputBytes": 0,
  "name": "string",
  "osFamily": "string",
  "params": [
    {
      "default": "string",
      "description": "string",
      "key": "string",
      "kind": "string",
      "label": "string",
      "options": [
        "string"
      ],
      "required": false
    }
  ],
  "runAsDefault": "string",
  "scope": "string",
  "tags": [
    "string"
  ],
  "timeoutSeconds": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/scripts");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/scripts/{scriptId}

GETscript:readshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Get script

Parameters

Name	In	Type	Required	Description
scriptId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, ScriptDetailView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold script:read.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	The script library is not available on this Depot.

200 response body

Field	Type	Description
approvalCleared	boolean
approvalFloorFrameworks	array of string
approvalReason	string
approvalTicket	string
approvedAt	string (date-time) or null
approvedBy	string
approvedByName	string
approvedVia	string
bodyrequired	string
bodySha256required	string
builtInrequired	boolean
categoryrequired	string
collectorFieldKeyrequired	string
collectorParseModerequired	string
descriptionrequired	string
interpreterrequired	string
isCollectorrequired	boolean
maxOutputBytesrequired	integer	int64.
namerequired	string
osFamilyrequired	string, one of any, linux, macos, windows
ownWork	boolean
paramsrequired	array of ScriptParamView
params[].defaultrequired	string
params[].descriptionrequired	string
params[].keyrequired	string
params[].kindrequired	string
params[].labelrequired	string
params[].optionsrequired	array of string
params[].requiredrequired	boolean
publicIdrequired	string
runAsDefaultrequired	string
scoperequired	string
secondPersonApprovedrequired	boolean
soleEditor	boolean
statusrequired	string
tagsrequired	array of string
timeoutSecondsrequired	integer
updatedAtrequired	string (date-time)
versionrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/scripts/<scriptId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/scripts/<scriptId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/scripts/<scriptId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/scripts/<scriptId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/scripts/<scriptId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/scripts/<scriptId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/v1/scripts/{scriptId}

PUTscript:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Update script

Parameters

Name	In	Type	Required	Description
scriptId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
body	string or null
category	string or null
collectorFieldKey	string or null
collectorParseMode	string or null
description	string or null
interpreter	string or null
isCollector	boolean or null
maxOutputBytes	integer or null	int64.
name	string or null
osFamily	string or null
paramsrequired	array of ScriptParamView
params[].defaultrequired	string
params[].descriptionrequired	string
params[].keyrequired	string
params[].kindrequired	string
params[].labelrequired	string
params[].optionsrequired	array of string
params[].requiredrequired	boolean
runAsDefault	string or null
scope	string or null
tagsrequired	array of string
timeoutSeconds	integer or null

Responses

Status	Body	Description
200	application/json, ScriptDetailView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	This script is in the shared library, which every workspace on this Depot reads, and it is not edited from inside one of them. Duplicate it and change your own copy instead.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	The script library is not available on this Depot.

200 response body

Field	Type	Description
approvalCleared	boolean
approvalFloorFrameworks	array of string
approvalReason	string
approvalTicket	string
approvedAt	string (date-time) or null
approvedBy	string
approvedByName	string
approvedVia	string
bodyrequired	string
bodySha256required	string
builtInrequired	boolean
categoryrequired	string
collectorFieldKeyrequired	string
collectorParseModerequired	string
descriptionrequired	string
interpreterrequired	string
isCollectorrequired	boolean
maxOutputBytesrequired	integer	int64.
namerequired	string
osFamilyrequired	string, one of any, linux, macos, windows
ownWork	boolean
paramsrequired	array of ScriptParamView
params[].defaultrequired	string
params[].descriptionrequired	string
params[].keyrequired	string
params[].kindrequired	string
params[].labelrequired	string
params[].optionsrequired	array of string
params[].requiredrequired	boolean
publicIdrequired	string
runAsDefaultrequired	string
scoperequired	string
secondPersonApprovedrequired	boolean
soleEditor	boolean
statusrequired	string
tagsrequired	array of string
timeoutSecondsrequired	integer
updatedAtrequired	string (date-time)
versionrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/scripts/<scriptId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "body": "string",
  "category": "string",
  "collectorFieldKey": "string",
  "collectorParseMode": "string",
  "description": "string",
  "interpreter": "string",
  "isCollector": false,
  "maxOutputBytes": 0,
  "name": "string",
  "osFamily": "string",
  "params": [
    {
      "default": "string",
      "description": "string",
      "key": "string",
      "kind": "string",
      "label": "string",
      "options": [
        "string"
      ],
      "required": false
    }
  ],
  "runAsDefault": "string",
  "scope": "string",
  "tags": [
    "string"
  ],
  "timeoutSeconds": 0
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "body": "string",
  "category": "string",
  "collectorFieldKey": "string",
  "collectorParseMode": "string",
  "description": "string",
  "interpreter": "string",
  "isCollector": false,
  "maxOutputBytes": 0,
  "name": "string",
  "osFamily": "string",
  "params": [
    {
      "default": "string",
      "description": "string",
      "key": "string",
      "kind": "string",
      "label": "string",
      "options": [
        "string"
      ],
      "required": false
    }
  ],
  "runAsDefault": "string",
  "scope": "string",
  "tags": [
    "string"
  ],
  "timeoutSeconds": 0
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/scripts/<scriptId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/scripts/<scriptId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "body": "string",
    "category": "string",
    "collectorFieldKey": "string",
    "collectorParseMode": "string",
    "description": "string",
    "interpreter": "string",
    "isCollector": False,
    "maxOutputBytes": 0,
    "name": "string",
    "osFamily": "string",
    "params": [
        {
            "default": "string",
            "description": "string",
            "key": "string",
            "kind": "string",
            "label": "string",
            "options": [
                "string",
            ],
            "required": False,
        },
    ],
    "runAsDefault": "string",
    "scope": "string",
    "tags": [
        "string",
    ],
    "timeoutSeconds": 0,
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "body": "string",
  "category": "string",
  "collectorFieldKey": "string",
  "collectorParseMode": "string",
  "description": "string",
  "interpreter": "string",
  "isCollector": false,
  "maxOutputBytes": 0,
  "name": "string",
  "osFamily": "string",
  "params": [
    {
      "default": "string",
      "description": "string",
      "key": "string",
      "kind": "string",
      "label": "string",
      "options": [
        "string"
      ],
      "required": false
    }
  ],
  "runAsDefault": "string",
  "scope": "string",
  "tags": [
    "string"
  ],
  "timeoutSeconds": 0
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/scripts/<scriptId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/scripts/<scriptId>";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "body": "string",
    "category": "string",
    "collectorFieldKey": "string",
    "collectorParseMode": "string",
    "description": "string",
    "interpreter": "string",
    "isCollector": false,
    "maxOutputBytes": 0,
    "name": "string",
    "osFamily": "string",
    "params": [
      {
        "default": "string",
        "description": "string",
        "key": "string",
        "kind": "string",
        "label": "string",
        "options": [
          "string"
        ],
        "required": false
      }
    ],
    "runAsDefault": "string",
    "scope": "string",
    "tags": [
      "string"
    ],
    "timeoutSeconds": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "body": "string",
  "category": "string",
  "collectorFieldKey": "string",
  "collectorParseMode": "string",
  "description": "string",
  "interpreter": "string",
  "isCollector": false,
  "maxOutputBytes": 0,
  "name": "string",
  "osFamily": "string",
  "params": [
    {
      "default": "string",
      "description": "string",
      "key": "string",
      "kind": "string",
      "label": "string",
      "options": [
        "string"
      ],
      "required": false
    }
  ],
  "runAsDefault": "string",
  "scope": "string",
  "tags": [
    "string"
  ],
  "timeoutSeconds": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/scripts/<scriptId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/v1/scripts/{scriptId}

DELETEscript:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Delete script

Parameters

Name	In	Type	Required	Description
scriptId	path	string	Yes	A uuid.

Responses

Status	Body	Description
204	None	Success, with no body.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	This script is in the shared library, which every workspace on this Depot reads, and it is not edited from inside one of them. Duplicate it and change your own copy instead.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	The script library is not available on this Depot.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/scripts/<scriptId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/scripts/<scriptId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/scripts/<scriptId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/scripts/<scriptId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/scripts/<scriptId>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/scripts/<scriptId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/scripts/{scriptId}/approve

POSTscript:approveshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Approve script

Parameters

Name	In	Type	Required	Description
scriptId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
acknowledgeWarningrequired	boolean
emergencyrequired	boolean
reasonrequired	string
soleEditorrequired	boolean
ticketrequired	string

Responses

Status	Body	Description
200	application/json, ScriptDetailView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	This script is in the shared library, which every workspace on this Depot reads, and it is not edited from inside one of them. Duplicate it and change your own copy instead.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	An emergency approval is for approving your own version or your own request. You can approve this one the ordinary way.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	The script library is not available on this Depot.

200 response body

Field	Type	Description
approvalCleared	boolean
approvalFloorFrameworks	array of string
approvalReason	string
approvalTicket	string
approvedAt	string (date-time) or null
approvedBy	string
approvedByName	string
approvedVia	string
bodyrequired	string
bodySha256required	string
builtInrequired	boolean
categoryrequired	string
collectorFieldKeyrequired	string
collectorParseModerequired	string
descriptionrequired	string
interpreterrequired	string
isCollectorrequired	boolean
maxOutputBytesrequired	integer	int64.
namerequired	string
osFamilyrequired	string, one of any, linux, macos, windows
ownWork	boolean
paramsrequired	array of ScriptParamView
params[].defaultrequired	string
params[].descriptionrequired	string
params[].keyrequired	string
params[].kindrequired	string
params[].labelrequired	string
params[].optionsrequired	array of string
params[].requiredrequired	boolean
publicIdrequired	string
runAsDefaultrequired	string
scoperequired	string
secondPersonApprovedrequired	boolean
soleEditor	boolean
statusrequired	string
tagsrequired	array of string
timeoutSecondsrequired	integer
updatedAtrequired	string (date-time)
versionrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/scripts/<scriptId>/approve' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "acknowledgeWarning": false,
  "emergency": false,
  "reason": "string",
  "soleEditor": false,
  "ticket": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "acknowledgeWarning": false,
  "emergency": false,
  "reason": "string",
  "soleEditor": false,
  "ticket": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/scripts/<scriptId>/approve' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/scripts/<scriptId>/approve"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "acknowledgeWarning": False,
    "emergency": False,
    "reason": "string",
    "soleEditor": False,
    "ticket": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "acknowledgeWarning": false,
  "emergency": false,
  "reason": "string",
  "soleEditor": false,
  "ticket": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/scripts/<scriptId>/approve", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/scripts/<scriptId>/approve";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "acknowledgeWarning": false,
    "emergency": false,
    "reason": "string",
    "soleEditor": false,
    "ticket": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "acknowledgeWarning": false,
  "emergency": false,
  "reason": "string",
  "soleEditor": false,
  "ticket": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/scripts/<scriptId>/approve");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/scripts/{scriptId}/duplicate

POSTscript:manageshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

duplicateScript copies a script into a new DRAFT.

It is how a built-in becomes editable, and how somebody starts from a working script rather than a blank page. The copy is never approved, whatever the original was: an approval is a signature over a body, and the copy is about to be edited.

THE COPY LANDS IN THE FACE’S SCOPE, not the source’s. That is what makes forking the shared “Flush DNS” from inside a client produce that client’s own copy, leaving every other client still running the original - which is the whole reason editing a built-in forks rather than edits.

Parameters

Name	In	Type	Required	Description
scriptId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
fromVersionrequired	integer

Responses

Status	Body	Description
201	application/json, ScriptDetailView	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	This script is in the shared library, which every workspace on this Depot reads, and it is not edited from inside one of them. Duplicate it and change your own copy instead.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	The script library is not available on this Depot.

201 response body

Field	Type	Description
approvalCleared	boolean
approvalFloorFrameworks	array of string
approvalReason	string
approvalTicket	string
approvedAt	string (date-time) or null
approvedBy	string
approvedByName	string
approvedVia	string
bodyrequired	string
bodySha256required	string
builtInrequired	boolean
categoryrequired	string
collectorFieldKeyrequired	string
collectorParseModerequired	string
descriptionrequired	string
interpreterrequired	string
isCollectorrequired	boolean
maxOutputBytesrequired	integer	int64.
namerequired	string
osFamilyrequired	string, one of any, linux, macos, windows
ownWork	boolean
paramsrequired	array of ScriptParamView
params[].defaultrequired	string
params[].descriptionrequired	string
params[].keyrequired	string
params[].kindrequired	string
params[].labelrequired	string
params[].optionsrequired	array of string
params[].requiredrequired	boolean
publicIdrequired	string
runAsDefaultrequired	string
scoperequired	string
secondPersonApprovedrequired	boolean
soleEditor	boolean
statusrequired	string
tagsrequired	array of string
timeoutSecondsrequired	integer
updatedAtrequired	string (date-time)
versionrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/scripts/<scriptId>/duplicate' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "fromVersion": 0
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "fromVersion": 0
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/scripts/<scriptId>/duplicate' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/scripts/<scriptId>/duplicate"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "fromVersion": 0,
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "fromVersion": 0
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/scripts/<scriptId>/duplicate", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/scripts/<scriptId>/duplicate";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "fromVersion": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "fromVersion": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/scripts/<scriptId>/duplicate");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/scripts/{scriptId}/move

POSTscript:manageshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

moveScript sends a script to the other library, keeping its id, its whole history and its version numbering.

IT NEEDS A TENANT ON THE REQUEST in either direction, because both directions have a client end: a global script moves INTO one client’s library and a client’s moves OUT of it. The practice face has no tenant and therefore cannot say which client is at the other end, so it is refused rather than guessed at.

The ordering, the crash window and why the reverse ordering is worse are all in scriptlib.Move; nothing about it is decided here.

Parameters

Name	In	Type	Required	Description
scriptId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
scoperequired	string

Responses

Status	Body	Description
200	application/json, ScriptDetailView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	Moving a script in or out of the shared library changes what every workspace on this Depot can run, so it is not done from inside one of them. Duplicate the script instead; the copy is your own.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	The script library is not available on this Depot.

200 response body

Field	Type	Description
approvalCleared	boolean
approvalFloorFrameworks	array of string
approvalReason	string
approvalTicket	string
approvedAt	string (date-time) or null
approvedBy	string
approvedByName	string
approvedVia	string
bodyrequired	string
bodySha256required	string
builtInrequired	boolean
categoryrequired	string
collectorFieldKeyrequired	string
collectorParseModerequired	string
descriptionrequired	string
interpreterrequired	string
isCollectorrequired	boolean
maxOutputBytesrequired	integer	int64.
namerequired	string
osFamilyrequired	string, one of any, linux, macos, windows
ownWork	boolean
paramsrequired	array of ScriptParamView
params[].defaultrequired	string
params[].descriptionrequired	string
params[].keyrequired	string
params[].kindrequired	string
params[].labelrequired	string
params[].optionsrequired	array of string
params[].requiredrequired	boolean
publicIdrequired	string
runAsDefaultrequired	string
scoperequired	string
secondPersonApprovedrequired	boolean
soleEditor	boolean
statusrequired	string
tagsrequired	array of string
timeoutSecondsrequired	integer
updatedAtrequired	string (date-time)
versionrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/scripts/<scriptId>/move' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "scope": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "scope": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/scripts/<scriptId>/move' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/scripts/<scriptId>/move"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "scope": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "scope": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/scripts/<scriptId>/move", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/scripts/<scriptId>/move";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "scope": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "scope": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/scripts/<scriptId>/move");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/scripts/{scriptId}/revisions

GETscript:readshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List script revisions

Parameters

Name	In	Type	Required	Description
scriptId	path	string	Yes	A uuid.
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.

Responses

Status	Body	Description
200	application/json, PagedResultScriptRevisionSummaryView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold script:read.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	The script library is not available on this Depot.

200 response body

Field	Type	Description
itemsrequired	array of ScriptRevisionSummaryView
items[].authoredAtrequired	string (date-time)
items[].authoredBy	string
items[].bodySha256required	string
items[].interpreterrequired	string
items[].namerequired	string
items[].originScoperequired	string
items[].osFamilyrequired	string
items[].reasonrequired	string, one of backfill, create, edit, fork, import, seed
items[].versionrequired	integer
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/scripts/<scriptId>/revisions?page=0&pageSize=0' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/scripts/<scriptId>/revisions?page=0&pageSize=0' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/scripts/<scriptId>/revisions"
params = {
    "page": "0",
    "pageSize": "0",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/scripts/<scriptId>/revisions?page=0&pageSize=0", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/scripts/<scriptId>/revisions");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/scripts/<scriptId>/revisions?page=0&pageSize=0");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/scripts/{scriptId}/revisions/{version}

GETscript:readshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

getScriptRevision reads one frozen text BY INTEGER VERSION.

By the integer and not by a revision id, because every batch, schedule and command row already records the integer, so it is the key an auditor is holding when they arrive here. A revision PublicId would be a second identifier that nothing else in the product names.

Parameters

Name	In	Type	Required	Description
scriptId	path	string	Yes	A uuid.
version	path	string	Yes

Responses

Status	Body	Description
200	application/json, ScriptRevisionView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold script:read.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	The script library is not available on this Depot.

200 response body

Field	Type	Description
authoredAtrequired	string (date-time)
authoredBy	string
bodyrequired	string
bodySha256required	string
collectorFieldKeyrequired	string
collectorParseModerequired	string
interpreterrequired	string
isCollectorrequired	boolean
maxOutputBytesrequired	integer	int64.
namerequired	string
originScoperequired	string
osFamilyrequired	string
paramsrequired	array of ScriptParamView
params[].defaultrequired	string
params[].descriptionrequired	string
params[].keyrequired	string
params[].kindrequired	string
params[].labelrequired	string
params[].optionsrequired	array of string
params[].requiredrequired	boolean
reasonrequired	string, one of backfill, create, edit, fork, import, seed
runAsDefaultrequired	string
timeoutSecondsrequired	integer
versionrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/scripts/<scriptId>/revisions/<version>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/scripts/<scriptId>/revisions/<version>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/scripts/<scriptId>/revisions/<version>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/scripts/<scriptId>/revisions/<version>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/scripts/<scriptId>/revisions/<version>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/scripts/<scriptId>/revisions/<version>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/scripts/{scriptId}/revoke

POSTscript:approveshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Revoke script

Parameters

Name	In	Type	Required	Description
scriptId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, ScriptDetailView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	This script is in the shared library, which every workspace on this Depot reads, and it is not edited from inside one of them. Duplicate it and change your own copy instead.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	The script library is not available on this Depot.

200 response body

Field	Type	Description
approvalCleared	boolean
approvalFloorFrameworks	array of string
approvalReason	string
approvalTicket	string
approvedAt	string (date-time) or null
approvedBy	string
approvedByName	string
approvedVia	string
bodyrequired	string
bodySha256required	string
builtInrequired	boolean
categoryrequired	string
collectorFieldKeyrequired	string
collectorParseModerequired	string
descriptionrequired	string
interpreterrequired	string
isCollectorrequired	boolean
maxOutputBytesrequired	integer	int64.
namerequired	string
osFamilyrequired	string, one of any, linux, macos, windows
ownWork	boolean
paramsrequired	array of ScriptParamView
params[].defaultrequired	string
params[].descriptionrequired	string
params[].keyrequired	string
params[].kindrequired	string
params[].labelrequired	string
params[].optionsrequired	array of string
params[].requiredrequired	boolean
publicIdrequired	string
runAsDefaultrequired	string
scoperequired	string
secondPersonApprovedrequired	boolean
soleEditor	boolean
statusrequired	string
tagsrequired	array of string
timeoutSecondsrequired	integer
updatedAtrequired	string (date-time)
versionrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/scripts/<scriptId>/revoke' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/scripts/<scriptId>/revoke' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/scripts/<scriptId>/revoke"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/scripts/<scriptId>/revoke", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/scripts/<scriptId>/revoke";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/scripts/<scriptId>/revoke");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());