> This page is for Developer. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.bigcommerce.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server. # Update Script PUT https://api.bigcommerce.com/stores/{store_hash}/v3/content/scripts/{uuid} Content-Type: application/json Updates a *Script*. Reference: https://docs.bigcommerce.com/developer/api-reference/rest/admin/content/marketing/scripts/update-script ## Authentication - `X-Auth-Token` header (required) — ### OAuth scopes | UI Name | Permission | Parameter | |:--------|:-----------|:----------| | Checkout Content | modify | `store_content_checkout` | | Checkout Content | read-only | `store_content_checkout_read_only` | | Content | modify | `store_v2_content` | | Content | read-only | `store_v2_content_read_only` | To read or modify scripts on checkout pages, add `Checkout Content` scopes. ### Authentication header | Header | Argument | Description | |:-------|:---------|:------------| | `X-Auth-Token` | `access_token` | For more about API accounts that generate `access_token`s, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts#api-accounts). | ### Further reading For example requests and more information about authenticating BigCommerce APIs, see [Authentication and Example Requests](/developer/docs/overview/api-fundamentals/api-accounts#x-auth-token-header-example-requests). For more about BigCommerce OAuth scopes, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts#oauth-scopes). For a list of API status codes, see [API Status Codes](/developer/api-reference/rest/overview#rest-http-status-codes). ## Request ### Path parameters - `uuid` (string, required) — The identifier for a specific script. - `store_hash` (string, required) — Permanent ID of the BigCommerce store. ### Headers - `Accept` (string, required, default: application/json) — The [MIME type](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types) of the response body. ### Body (application/json) This endpoint expects a script_Put. - `api_client_id` (string, optional) — The client id of the API user that created this script, or blank if created by other means. - `auto_uninstall` (boolean, optional) — It will enable automatic cleanup of the script when the single click app is uninstalled or OAuth token is revoked. - `channel_id` (integer, optional) - `consent_category` (enum, optional) — Consent category for GDPR and CCPA compliance. Defaults to `unknown` when not specified. Scripts with an `unknown` consent category do not display on stores with customer cookie consent banners enabled. - Allowed values: `essential`, `functional`, `analytics`, `targeting` - `description` (string, optional) — The user-friendly description. - `enabled` (boolean, optional) — Whether the script is enabled or disabled on the storefront. - `html` (string, optional) — An HTML string containing exactly one `script` tag. Present when the script `kind` is `script_tag`. - `integrity_hashes` (list of string, optional) — Array of [Subresource integrity (SRI) hashes](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) for external SRC scripts that lets browsers validate the contents of the script. The hash is the `integrity` attribute on the `script` tag. You can add up to five hashes for a script and generate them using any SRI standard-supported algorithm, including SHA-256, SHA-384, and SHA-512. If you provide more than one hash, they will all be added to the `integrity` attribute in order, separated by whitespace. - `kind` (enum, optional) — What type of script this is. `src` - For scripts that use the src URL. A `script` tag will be generated with its `src` attribute set to the value of the `src` property. When your app provides a path to the script, we can optimize and add the script automatically for you. The load_method can vary. `script_tag` - For scripts that include a raw HTML `script` tag-enclosed block of JavaScript. The value of `html` is added directly to the page. The load_method must be default. - Allowed values: `src`, `script_tag` - `load_method` (enum, optional) — The load method to use for the script. Values are `default`, `async`, or `defer`. It determines how the script should be loaded into the page. - Allowed values: `default`, `async`, `defer` - `location` (enum, optional) — Where on the page to place the script. Values are `head` or `footer`. - Allowed values: `head`, `footer` - `name` (string, optional) — The user-friendly name. - `src` (string, optional) — The `src` attribute of the script to load. Only present if `kind` is `src`. - `visibility` (enum, optional) — Which set of pages the script should load on. Please note that you need to have `Checkout content` scope to use `all_pages` and `checkout`. - The current visibility options are `storefront`, `checkout`, `all_pages` and `order_confirmation`. `storefront`: All pages that are not `checkout` or `order_confirmation`. For a list of all locations visit [Scripts Visibility](/developer/docs/integrations/scripts#script-visibility-locations). - Allowed values: `storefront`, `all_pages`, `checkout`, `order_confirmation` ## Response ### 200 OK - `data` (script_Full, optional) - `meta` (Meta, optional) — Response metadata. ## Errors ### 404 Not Found Error The resource was not found. - `status` (integer, optional) — The HTTP status code. - `title` (string, optional) — The error title describing the particular error. - `type` (string, optional) - `instance` (string, optional) - `errors` (ContentScriptsUuidPutResponsesContentApplicationJsonSchemaErrors, optional) ### 422 Unprocessable Entity Error This is the result of missing required fields, or of invalid data. See the response for more details. - `status` (integer, optional) — The HTTP status code. - `title` (string, optional) — The error title describing the particular error. - `type` (string, optional) - `instance` (string, optional) - `errors` (ContentScriptsUuidPutResponsesContentApplicationJsonSchemaErrors, optional) ## Types ### script_Full - `api_client_id` (string, optional) — The client id of the API user that created this script, or blank if created by other means. - `auto_uninstall` (boolean, optional) — It will enable automatic cleanup of the script when the single click app is uninstalled or OAuth token is revoked. - `channel_id` (integer, optional) - `consent_category` (enum, optional) — Consent category for GDPR and CCPA compliance. Defaults to `unknown` when not specified. Scripts with an `unknown` consent category do not display on stores with customer cookie consent banners enabled. - Allowed values: `essential`, `functional`, `analytics`, `targeting` - `date_created` (datetime, optional) — The date on which this object was initially created. - `date_modified` (datetime, optional) — The date on which this object was last updated. - `description` (string, optional) — The user-friendly description. - `enabled` (boolean, optional) — Whether the script is enabled or disabled on the storefront. - `html` (string, optional) — An HTML string containing exactly one `script` tag. Present when the script `kind` is `script_tag`. - `integrity_hashes` (list of string, optional) — Array of [Subresource integrity (SRI) hashes](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) for external SRC scripts that lets browsers validate the contents of the script. The hash is the `integrity` attribute on the `script` tag. You can add up to five hashes for a script and generate them using any SRI standard-supported algorithm, including SHA-256, SHA-384, and SHA-512. If you provide more than one hash, they will all be added to the `integrity` attribute in order, separated by whitespace. - `kind` (enum, optional) — What type of script this is. `src` - For scripts that use the src URL. A `script` tag will be generated with its `src` attribute set to the value of the `src` property. When your app provides a path to the script, we can optimize and add the script automatically for you. The load_method can vary. `script_tag` - For scripts that include a raw HTML `script` tag-enclosed block of JavaScript. The value of `html` is added directly to the page. The load_method must be default. - Allowed values: `src`, `script_tag` - `load_method` (enum, optional) — The load method to use for the script. Values are `default`, `async`, or `defer`. It determines how the script should be loaded into the page. - Allowed values: `default`, `async`, `defer` - `location` (enum, optional) — Where on the page to place the script. Values are `head` or `footer`. - Allowed values: `head`, `footer` - `name` (string, optional) — The user-friendly name. - `src` (string, optional) — The `src` attribute of the script to load. Only present if `kind` is `src`. - `uuid` (string, optional) — The primary identifier. - `visibility` (enum, optional) — Which set of pages the script should load on. Please note that you need to have `Checkout content` scope to use `all_pages` and `checkout`. - The current visibility options are `storefront`, `checkout`, `all_pages` and `order_confirmation`. `storefront`: All pages that are not `checkout` or `order_confirmation`. For a list of all locations visit [Scripts Visibility](/developer/docs/integrations/scripts#script-visibility-locations). - Allowed values: `storefront`, `all_pages`, `checkout`, `order_confirmation` ### Meta Response metadata. ### ContentScriptsUuidPutResponsesContentApplicationJsonSchemaErrors ## Examples **Request** ```json {} ``` **Response** ```json { "data": { "api_client_id": "string", "auto_uninstall": true, "channel_id": 1, "consent_category": "essential", "date_created": "2024-01-15T09:30:00Z", "date_modified": "2024-01-15T09:30:00Z", "description": "string", "enabled": true, "html": "string", "integrity_hashes": [ "sha384-DgtwqxoPLKnJSER+TUmSPIpE6ZbVb2ZZwR241HHiqJipLiZQPN/JkKX5xxrEHUTt", "sha384-UiwrqEuzfCtJKLI+dXmPNOpE6ZvBh2IIqT371rJiqJxyKjZ6PP/JmSD5hdsEUPOl" ], "kind": "src", "load_method": "default", "location": "head", "name": "string", "src": "https://code.jquery.com/jquery-3.2.1.min.js", "uuid": "string", "visibility": "storefront" }, "meta": {} } ``` **SDK Code** ```python import requests url = "https://api.bigcommerce.com/stores/store_hash/v3/content/scripts/03805148-a592-4803-9482-e91fe5c1be12" payload = {} headers = { "Accept": "application/json", "X-Auth-Token": "", "Content-Type": "application/json" } response = requests.put(url, json=payload, headers=headers) print(response.json()) ``` ```javascript const url = 'https://api.bigcommerce.com/stores/store_hash/v3/content/scripts/03805148-a592-4803-9482-e91fe5c1be12'; const options = { method: 'PUT', headers: { Accept: 'application/json', 'X-Auth-Token': '', 'Content-Type': 'application/json' }, body: '{}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://api.bigcommerce.com/stores/store_hash/v3/content/scripts/03805148-a592-4803-9482-e91fe5c1be12" payload := strings.NewReader("{}") req, _ := http.NewRequest("PUT", url, payload) req.Header.Add("Accept", "application/json") req.Header.Add("X-Auth-Token", "") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://api.bigcommerce.com/stores/store_hash/v3/content/scripts/03805148-a592-4803-9482-e91fe5c1be12") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Put.new(url) request["Accept"] = 'application/json' request["X-Auth-Token"] = '' request["Content-Type"] = 'application/json' request.body = "{}" response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.put("https://api.bigcommerce.com/stores/store_hash/v3/content/scripts/03805148-a592-4803-9482-e91fe5c1be12") .header("Accept", "application/json") .header("X-Auth-Token", "") .header("Content-Type", "application/json") .body("{}") .asString(); ``` ```php request('PUT', 'https://api.bigcommerce.com/stores/store_hash/v3/content/scripts/03805148-a592-4803-9482-e91fe5c1be12', [ 'body' => '{}', 'headers' => [ 'Accept' => 'application/json', 'Content-Type' => 'application/json', 'X-Auth-Token' => '', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://api.bigcommerce.com/stores/store_hash/v3/content/scripts/03805148-a592-4803-9482-e91fe5c1be12"); var request = new RestRequest(Method.PUT); request.AddHeader("Accept", "application/json"); request.AddHeader("X-Auth-Token", ""); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = [ "Accept": "application/json", "X-Auth-Token": "", "Content-Type": "application/json" ] let parameters = [] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://api.bigcommerce.com/stores/store_hash/v3/content/scripts/03805148-a592-4803-9482-e91fe5c1be12")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "PUT" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```