# Get started (/en/docs/platform/features/pci-dss/get-started)





This page is the shortest path to a script inventory you could show an assessor.

## Prerequisites [#prerequisites]

Before you start, make sure you have:

* A plan that includes compliance.
* Website role **Manager** to define scope and rules, **Analyst** to review scripts.
* `'report-sha256'` present in your `script-src`. Without it there are no hash reports and the inventory stays empty. Check [CSP hashes](/en/docs/platform/monitoring/script-hash) shows data before going further.

## 1. Define payment-page scope [#1-define-payment-page-scope]

Go to **PCI DSS** > **Payment pages** and select **Add payment page**.

Give it a name and a URL pattern. `*` is the only wildcard, it matches any characters including slashes, and the pattern must match the whole URL.

```text
https://shop.example.com/checkout*
```

Add one pattern per distinct flow rather than one clever pattern for all of them. It keeps the coverage numbers readable and lets you turn a flow off without touching the others.

Scope is the gate for everything else. Only scripts observed on a matching page enter the inventory. For more information, refer to [Payment pages](/en/docs/platform/features/pci-dss/payment-pages).

A pattern goes in the Page URL pattern field:

<img alt="The Add payment page dialog, with a name filled in and a wildcard pattern in Page URL pattern" src="__img0" width="1412" height="460" />

## 2. Wait for the inventory to build [#2-wait-for-the-inventory-to-build]

Reconciliation runs hourly, and creating a payment page enqueues it immediately, so the inventory usually populates within a few minutes.

If the inventory stays empty, the likely cause is that your patterns do not match the URLs browsers actually reported. Compare them against the document URLs on the [CSP hashes](/en/docs/platform/monitoring/script-hash) page.

## 3. Automate the scripts you already trust [#3-automate-the-scripts-you-already-trust]

Before reviewing anything by hand, go to **PCI DSS** > **Justification rules** and add rules for the things you will approve anyway: your own origin, and payment providers you have already vetted.

```text
https://js.stripe.com/*
```

A rule needs a name, a pattern, and a justification. The justification text is what an assessor reads, so write the business reason rather than "trusted".

Rules apply retroactively. Creating one justifies matching scripts already in the inventory, not just future ones. For more information, refer to [Justification rules](/en/docs/platform/features/pci-dss/justification-rules).

## 4. Review what is left [#4-review-what-is-left]

Open **PCI DSS** > **Script inventory** and the **Action required** tab. This is the list that matters: scripts nobody has decided on, plus scripts whose hash changed since they were justified.

Select a script, then **Justify** or **Mark rejected**, and write the reason. Both require text.

<Callout type="warn" title="Rejecting does not block anything">
  Marking a script rejected records your decision. It does not stop the script loading. Remove it from the page, or from your policy, as a separate action.
</Callout>

For more information, refer to [Justifying scripts](/en/docs/platform/features/pci-dss/justifying-scripts).

## 5. Export the evidence pack [#5-export-the-evidence-pack]

From **PCI DSS** > **Overview**, select **Export evidence pack**. You get a ZIP with a PDF report and two complete CSVs.

Do this once early, before you need it, so you know what your assessor will be reading. For more information, refer to [Evidence export](/en/docs/platform/features/pci-dss/evidence-export).

## Keep the inventory current [#keep-the-inventory-current]

Review coverage will not stay at 100%. New scripts arrive as unreviewed, and a justified script whose hash changes moves to **Needs review** automatically.

Set an alert on the `Unjustified script on payment pages` event so you find out without checking. For more information, refer to [Alert rules](/en/docs/platform/features/alerting/rules).

## Next steps [#next-steps]

You now have a reviewed script inventory and an evidence pack you could hand to an assessor. Keep it current by working the review queue whenever a hash changes.

* [Payment pages](/en/docs/platform/features/pci-dss/payment-pages)
* [Justification rules](/en/docs/platform/features/pci-dss/justification-rules)
* [Justifying scripts](/en/docs/platform/features/pci-dss/justifying-scripts)