Scripts
Scripts are reusable JavaScript functions that extend integration behavior. Use them as hooks in flows, logic in APIs and tools, or prompts in AI agents.
Script schema
Returns all scripts in the account. Response omits content to reduce payload size.
Maximum number of scripts to return per page.
1000Example: 100Comma-separated list of fields to project into each returned record.
Triggers summary projection: the response contains a minimal identity
set (_id, name, plus resource-specific fields) with the requested
fields added on top. Supports dot notation for nested fields.
Mutually exclusive with exclude.
_integrationId,disabled,lastModifiedComma-separated list of fields to strip from the default response.
Unlike include, does not trigger summary projection — returns the
full record with the named fields removed. Protected identity fields
(e.g. name) cannot be stripped. Mutually exclusive with include.
createdAt,lastModifiedArray of script objects.
No scripts exist in the account.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
GET /v1/scripts HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
[
{
"_id": "6356f24327114d57ab843e1f",
"name": "Add Discounts",
"sandbox": false,
"postResponseHookToProcessOnChildRecord": false,
"createdAt": "2022-10-24T20:14:59.070Z",
"lastModified": "2026-04-18T13:52:49.729Z"
},
{
"_id": "683e20e605d370cc2ec1798c",
"name": "Order Transform",
"description": "Transforms order data before import",
"sandbox": false,
"postResponseHookToProcessOnChildRecord": false,
"_sourceId": "6356f24327114d57ab843e1f",
"createdAt": "2025-06-02T22:08:38.739Z",
"lastModified": "2025-06-02T22:08:38.819Z"
}
]Creates a new script.
Fields for creating or updating a script.
Display name for the script.
Order Transform HookFree-text explanation of what the script does.
Adds discount line items to each order before importJavaScript source code. Optional on create — the server initializes omitted content to an empty string. Omitting it on update leaves the stored source unchanged (it is not cleared).
function preSavePage(options) { return { data: options.data, errors: options.errors }; }When true, postResponseMap hooks run once per child record in a one-to-many mapping instead of once per parent.
falseOptional template identifier used to generate or structure script content.
Created script.
Script resource as returned by the API.
Unique identifier for the script.
6356f24327114d57ab843e1fDisplay name for the script.
Order Transform HookFree-text explanation of what the script does.
Adds discount line items to each order before importJavaScript source code. Only returned on GET-by-ID, omitted from list responses to reduce payload size.
function preSavePage(options) { return { data: options.data, errors: options.errors }; }When true, postResponseMap hooks run once per child record in a one-to-many mapping instead of once per parent.
falseDebug logging is active until this timestamp. Absent or in the past means debug is off. Can only be set via PATCH — ignored on POST and PUT. Maximum 1 hour from the current time.
2026-05-22T03:30:00.000ZSource script this was cloned from. Present only on scripts created by cloning.
6356f24327114d57ab843e1fThe template (templates resource) this script was generated from. Present only on scripts created from a template; omitted otherwise.
64a1b2c3d4e5f6a7b8c9d0e1Timestamp when the script was created.
2022-10-24T20:14:59.070ZTimestamp when the script was last updated.
2026-04-18T13:52:49.729ZBad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
POST /v1/scripts HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 123
{
"name": "My Hook",
"content": "function preSavePage(options) {\n return { data: options.data, errors: options.errors };\n}"
}{
"_id": "683e20e605d370cc2ec1798c",
"name": "Order Transform",
"sandbox": false,
"postResponseHookToProcessOnChildRecord": false,
"createdAt": "2025-06-02T22:08:38.739Z",
"lastModified": "2025-06-02T22:08:38.819Z"
}Returns a single script by ID, including the full content field.
Script ID.
Script object.
Script resource as returned by the API.
Unique identifier for the script.
6356f24327114d57ab843e1fDisplay name for the script.
Order Transform HookFree-text explanation of what the script does.
Adds discount line items to each order before importJavaScript source code. Only returned on GET-by-ID, omitted from list responses to reduce payload size.
function preSavePage(options) { return { data: options.data, errors: options.errors }; }When true, postResponseMap hooks run once per child record in a one-to-many mapping instead of once per parent.
falseDebug logging is active until this timestamp. Absent or in the past means debug is off. Can only be set via PATCH — ignored on POST and PUT. Maximum 1 hour from the current time.
2026-05-22T03:30:00.000ZSource script this was cloned from. Present only on scripts created by cloning.
6356f24327114d57ab843e1fThe template (templates resource) this script was generated from. Present only on scripts created from a template; omitted otherwise.
64a1b2c3d4e5f6a7b8c9d0e1Timestamp when the script was created.
2022-10-24T20:14:59.070ZTimestamp when the script was last updated.
2026-04-18T13:52:49.729ZUnauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
GET /v1/scripts/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"_id": "6356f24327114d57ab843e1f",
"name": "Add Discounts",
"sandbox": false,
"postResponseHookToProcessOnChildRecord": false,
"content": "function preSavePage(options) {\n return { data: options.data, errors: options.errors };\n}",
"createdAt": "2022-10-24T20:14:59.070Z",
"lastModified": "2026-04-18T13:52:49.729Z"
}Replaces a script's mutable fields.
Script ID.
Fields for creating or updating a script.
Display name for the script.
Order Transform HookFree-text explanation of what the script does.
Adds discount line items to each order before importJavaScript source code. Optional on create — the server initializes omitted content to an empty string. Omitting it on update leaves the stored source unchanged (it is not cleared).
function preSavePage(options) { return { data: options.data, errors: options.errors }; }When true, postResponseMap hooks run once per child record in a one-to-many mapping instead of once per parent.
falseOptional template identifier used to generate or structure script content.
Updated script.
Script resource as returned by the API.
Unique identifier for the script.
6356f24327114d57ab843e1fDisplay name for the script.
Order Transform HookFree-text explanation of what the script does.
Adds discount line items to each order before importJavaScript source code. Only returned on GET-by-ID, omitted from list responses to reduce payload size.
function preSavePage(options) { return { data: options.data, errors: options.errors }; }When true, postResponseMap hooks run once per child record in a one-to-many mapping instead of once per parent.
falseDebug logging is active until this timestamp. Absent or in the past means debug is off. Can only be set via PATCH — ignored on POST and PUT. Maximum 1 hour from the current time.
2026-05-22T03:30:00.000ZSource script this was cloned from. Present only on scripts created by cloning.
6356f24327114d57ab843e1fThe template (templates resource) this script was generated from. Present only on scripts created from a template; omitted otherwise.
64a1b2c3d4e5f6a7b8c9d0e1Timestamp when the script was created.
2022-10-24T20:14:59.070ZTimestamp when the script was last updated.
2026-04-18T13:52:49.729ZBad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
PUT /v1/scripts/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 132
{
"name": "Add Discounts v2",
"content": "function preSavePage(options) {\n return { data: options.data, errors: options.errors };\n}"
}{
"_id": "6356f24327114d57ab843e1f",
"name": "Add Discounts v2",
"sandbox": false,
"postResponseHookToProcessOnChildRecord": false,
"content": "function preSavePage(options) {\n return { data: options.data, errors: options.errors };\n}",
"createdAt": "2022-10-24T20:14:59.070Z",
"lastModified": "2026-04-21T09:05:11.342Z"
}Deletes a script. Soft-deleted and retained in the recycle bin for 30 days.
Script ID.
Script deleted.
No content
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
The resource has dependents that must be deleted first. Each entry
in the errors array names one blocking resource.
DELETE /v1/scripts/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
No content
Partially updates a script using JSON Patch (RFC 6902). Only /debugUntil is a supported path — all others are rejected with 422. Supported operations: replace, add, remove. The value must be an ISO-8601 timestamp no more than 1 hour in the future.
Script ID.
The operation to perform.
JSON Pointer to the field to patch.
ISO-8601 timestamp. Required for replace and add, omit for remove.
2026-05-02T16:00:00.000ZScript patched.
No content
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
PATCH /v1/scripts/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 74
[
{
"op": "replace",
"path": "/debugUntil",
"value": "2026-05-02T16:00:00.000Z"
}
]No content
Returns the script's execution log — the entries its console.* calls wrote during real runs of the flows, APIs and Tools whose steps use the script. console.log, console.info, console.warn and console.error output is recorded on every real run regardless of the parent's logging mode (a flow's log level, an API's request logging, a Tool invoke without x-log-mode); console.debug output is recorded only while the script's debugUntil is in the future. Entries stay readable after a debug window closes. Test runs execute the script but write no entries.
The window is read from time_lte downward, one time slice at a time, and each call returns one slice. A response with an empty logs array and a nextPageURL means that slice held nothing while the rest of the window is still unread — follow the cursor until a response arrives without one. Only an empty logs array with no nextPageURL means the window holds no entries. To read a known run in one call, set time_lte a few seconds after the run ended.
Script ID.
Upper bound of the time window (inclusive), as epoch milliseconds. Defaults to now if omitted. Reading starts here and proceeds backward.
Lower bound of the time window (exclusive), as epoch milliseconds.
Restricts entries to hooks that ran inside this parent. Despite the name it matches the containing flow, API, or Tool alike — pass whichever the hook step lives in.
Restricts entries to hooks that ran on this export or import step.
Restricts entries to one hook type (for example preMap or postResponseMap).
One slice of the script's execution log.
Path of the next slice to read, carrying the same filters with time_lte moved
back to the slice boundary. Present whenever unread window remains — including
when logs is empty. Absent once the window is exhausted.
/v1/scripts/6843b67b35b64c0bcba2fd69/logs?time_gt=1790869357487&time_lte=1790955400000Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
GET /v1/scripts/{_id}/logs HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"logs": [
{
"time": "2026-05-22 01:24:38.697",
"functionType": "preSavePage",
"_resourceId": "6843b67b35b64c0bcba2fd69",
"logLevel": "WARN",
"message": "test warning from preSavePage"
},
{
"time": "2026-05-22 01:24:38.697",
"functionType": "preSavePage",
"_resourceId": "6843b67b35b64c0bcba2fd69",
"logLevel": "INFO",
"message": "test log message from preSavePage"
}
]
}Deletes every entry in the script's execution log — the same action as the script page's Clear logs. Synchronous and idempotent; succeeds when the script has no entries. The only way, apart from account retention, that entries leave the log.
Script ID.
Logs deleted.
No content
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
DELETE /v1/scripts/{_id}/logs HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
No content
Returns the change history for a script. Each entry records a mutation event with who made the change, when, and which fields were affected.
Script ID.
6356f24327114d57ab843e1fMaximum number of audit entries to return per page.
1000Example: 100Opaque pagination cursor for the next page. Take it from the after value in the Link
response header's rel="next" URL rather than constructing it.
W3siJGRhdGUiOiIyMDI2LTA1LTAxVDAwOjAwOjAwLjAwMFoifSwiNjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIl0Only return entries at or after this timestamp.
2026-05-01T00:00:00.000ZOnly return entries at or before this timestamp.
2026-05-31T23:59:59.999ZFilter by the change type. Maps to the event field on each entry.
updatePossible values: Filter by how the change was initiated.
uiPossible values: Filter to changes performed by a single user.
624cb0346309dc3a543733a2Array of audit entries, newest first.
No audit entries exist for this script.
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
GET /v1/scripts/{_id}/audit HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
[
{
"_id": "69e38cb1a749d34a9732a270",
"resourceType": "script",
"_resourceId": "6356f24327114d57ab843e1f",
"source": "api",
"event": "update",
"time": "2026-04-18T13:52:49.729Z",
"byUser": {
"_id": "624cb0346309dc3a543733a2",
"email": "user@example.com",
"name": "Tyler Lamparter"
},
"fieldChanges": [
{
"fieldPath": "debugUntil",
"oldValue": "2026-04-18T14:52:43.041Z"
}
]
}
]Returns the set of resources that depend on the specified script.
Script ID.
Dependency map. Keys are resource-type strings; values are arrays
of dependency entries. Returns {} when no dependents exist.
Map of dependent-resource types to arrays of dependency entries.
Keys are plural resource type strings (e.g. flows, imports,
connections). An empty object {} means no dependents.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
GET /v1/scripts/{_id}/dependencies HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{}Last updated
Was this helpful?