Authenticated dashboard API
The browser uses same-origin /api/platform/* handlers backed by revocable server sessions. Website authentication uses a secure HttpOnly cookie and an anti-forgery token on mutations; raw access tokens are not stored in browser localStorage.
The server API uses /platform/auth/register, /platform/auth/verify and /platform/auth/login. Registration returns a verification challenge only after email delivery; completing verification establishes a session. Protected /platform routes require the current opaque bearer token. Old JWT account routes are retired.
| Route | Purpose |
|---|---|
| GET /platform/instances | Owned APITHost hosting instances |
| GET /platform/scripts | Purchased and connected scripts |
| POST /platform/purchases/quote | Current script and hosting quote |
| POST /platform/purchases | Pay the quote from the shared wallet |
| GET /platform/billing | Wallet, invoices and payment history |
| GET /platform/notifications/events | Owned resumable notification events |
| POST /platform/ai/conversations | A conversation scoped to an owned installation or instance |
Conventions and base URLs
Website examples are relative to https://scriptbox.app. Installer examples use https://api.scriptbox.app/installer/v1. Send and accept JSON unless an artifact response explicitly uses another content type.
const website = 'https://scriptbox.app';
const installer = 'https://api.scriptbox.app/installer/v1';Website hosting catalog
The same-origin website proxy exposes the live public hosting catalog used by the Header hosting chooser. The list response contains hostingTypes, currencies, and sourceCurrency. A detail response contains hostingType, currencies, and sourceCurrency.
GET /api/hosting/catalog
GET /api/hosting/catalog/{slug}
{
"success": true,
"data": {
"hostingTypes": [],
"currencies": [{ "code": "USD", "symbol": "$", "exchangeRate": 1 }],
"sourceCurrency": "USD"
}
}Search the installer catalog
Catalog search accepts bounded filters. Use the returned meta and facets rather than assuming a fixed number of categories, price ranges, pages, or scripts.
- sort: recent, popular, or rating
- price_range: all, under20, 20to50, 50to100, or over100
- per_page: 1 through 50
- tags: up to 20 positive numeric identifiers
curl --request POST \
'https://api.scriptbox.app/installer/v1/catalog/search' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--data '{"search":"commerce","sort":"recent","page":1,"per_page":12}'Read a catalog item
Request a specific public script ID to obtain its sanitized detail projection. Media values are validated public references. Generic credentials and private delivery fields are excluded; a bounded demo access projection may be present when explicitly configured.
curl --fail --show-error \
'https://api.scriptbox.app/installer/v1/catalog/SCR-001' \
--header 'Accept: application/json'Responses and errors
Installer endpoints use a stable envelope. Check the HTTP status and success field. Record request_id for support, but do not expose tokens or private request bodies. Rate-limited callers should honor Retry-After when it is returned.
{
"success": false,
"data": null,
"error": {
"code": "VALIDATION_ERROR",
"message": "Request validation failed",
"details": null
},
"request_id": "..."
}| Status | Meaning | Caller action |
|---|---|---|
| 400 / 422 | Invalid request | Correct the request; do not retry unchanged. |
| 401 / 403 | Missing, expired, or insufficient authorization | Start or refresh the approved session flow. |
| 404 | Public item or route not found | Recheck the identifier or refresh catalog data. |
| 429 | Rate limited | Wait for Retry-After before retrying. |
| 5xx | Service unavailable or server failure | Retry with backoff and preserve the request ID. |