Script resource and endpoints

A Script is a declarative backend endpoint that the frontend calls over HTTP (its concept and top-level structure are covered in Script Overview). This page covers the sys structure and body properties of the Script resource, along with the specification of the HTTP endpoints that author and run a Script.

A Script is handled by two management APIs. On CMA (Weegloo User identity) you can do it all: list, read, create, update, delete, execute, and poll. On ACMA (the ServiceUser identity of an end-user who signed up for the product) you can only execute and poll; authoring (create, update, delete) is CMA-only. The read-only delivery APIs (CDA, ACDA) have no Script.

A Script is a resource that carries a version, and it is a billable resource subject to a per-plan count limit. Unlike Content or Media, however, it has no publish status. Its sys has no publish-related properties such as status or publish; only version goes up with each change. Because there is no concept of publishing or unpublishing, deletion happens right away without unpublishing first.

Resource structure

The following is the single-read response for the Script "t6-http". Along with sys (system properties), it has two body properties, name and definition.

{
  "sys": {
    "id": "3trmXRMZcTAjDnphewjj1AaxYcaxlK",
    "type": "Script",
    "space": { "sys": { "id": "6jSUUAWT", "type": "Refer", "targetType": "Space" } },
    "createdBy": { "sys": { "id": "3p4tcFbQYJNvYTBJf2rYKr42xegQLJ", "type": "Refer", "targetType": "User" } },
    "createdAt": "2026-07-15T12:35:47.575Z",
    "updatedBy": { "sys": { "id": "3p4tcFbQYJNvYTBJf2rYKr42xegQLJ", "type": "Refer", "targetType": "User" } },
    "updatedAt": "2026-07-15T12:35:47.575Z",
    "version": 1
  },
  "name": "t6-http",
  "definition": {
    "method": "Post",
    "executionMode": "Async",
    "statements": [
      {
        "name": "resp",
        "method": "POST",
        "url": "https://postman-echo.com/post",
        "headers": [ { "key": "Content-Type", "value": "application/json", "secret": false } ],
        "body": { "prompt": "{ /payload/prompt }" },
        "timeoutMs": 10000,
        "retry": 0,
        "type": "Http"
      },
      {
        "value": { "status": "{ /resp/status }", "prompt": "{ /resp/body/json/prompt }" },
        "isError": false,
        "statusCode": 200,
        "type": "Return"
      }
    ]
  }
}

Key properties:

• sys.id: The unique identifier of the Script. It goes into {scriptId} in the single-read, update, delete, and execute paths.
• name: The name of the Script (1-64 characters). Used in the on-screen list and for management identification.
• definition: The ScriptDefinition that declares what this Script does. It consists of the call method (method), the execution mode (executionMode), the statements array, and an optional payload schema (payloadSchema). Its detailed structure is covered in Definition and name below and in the top-level structure in Script Overview.

Note that sys has no status, publish, or archive. A Script is not a resource that gets published to a delivery path; it is a resource you author and run through the management APIs.

System properties (sys)

Every Script carries common system properties in the sys object. space, createdBy, and updatedBy are in the Refer shape ({ "sys": { "id", "type": "Refer", "targetType" } }).

The status (publish status) and publish (publish history) found in the sys of Content, Content Type, and Media are not present on a Script, because a Script is not published. There is no archive property either. As a result, a Script's version increases purely with the number of creates and updates, without any publishing.

Definition and name (name, definition)

A Script has two body properties: name and definition.

Keys of definition (ScriptDefinition):

The kinds and fields of each statement you put in the statements array are covered in Statement catalog, and the { /pointer } expressions that pass values through are covered in Value expressions.

In the "t6-http" example above, definition has method Post and executionMode Async; it calls an external API with an Http statement and then returns the result with a Return statement. A Script with external I/O, such as the Http statement, must have executionMode set to Async (see Constraints below).

Constraints

The static constraints above are checked at save time (create/update), and a violation causes the save to be rejected. At save time, the system also checks whether the author actually holds the resource and action permissions that those statements use (if any one is missing, it is rejected with WGL403015). The detailed rules and time budget are covered in Execution semantics, limits, and security.

A Script is a billable resource, and the number per Organization is limited by plan (Free 3 / Basic 10 / Pro 50 / Enterprise unlimited). Once the limit is reached, creating a new Script is rejected (see per-plan count limits).

API

The base URL for the list, read, create, update, and delete endpoints below is CMA's https://cma.weegloo.com/v1, and a Bearer token that authenticates against CMA is required in the Authorization header. Update must also send the X-Weegloo-Version header (the current resource's sys.version) for optimistic concurrency control.

Execution (/execute) and polling (/executions/{requestId}) are also provided on ACMA at the same paths. In that case the base URL is https://acma.weegloo.com/v1, and you authenticate with a Bearer token of the ServiceUser identity. Authoring (create, update, delete) is not on ACMA and is CMA-only.

The completion response in the execution and polling examples above has no return, because the target Script finished without reaching a Return that carries a value (in which case statusCode defaults to 200). If a Return returns a value, the response carries return (or error if Return.isError is true). The full rules for the response are covered in the request and response section in Script Overview.

Related documents

• Script Overview: Covers the top-level ScriptDefinition structure, execution modes, and request/response.
• Statement catalog: Covers the fields and results of each statement you put in statements.
• Value expressions: Covers { /pointer } references and JsonLogic operations.
• Execution semantics, limits, and security: Covers static constraints, per-plan count limits, and the permission and security model.
• SpaceRole and ServiceUserRole: Cover how to grant a Script's action permissions (including Execute) to a role.