# Reconciliation (/en/docs/platform/features/pci-dss/reconcile)



Reconciliation is the pass that turns hash reports into inventory rows. It matches reported page URLs against your payment-page patterns, works out which scripts are in scope, applies justification rules, and writes any changes to the ledger.

You rarely need to trigger it.

## Automatic schedule [#automatic-schedule]

A pass is enqueued in three situations:

* **Hourly**, for every website on a plan with compliance.
* **Immediately**, when you create, update, or delete a payment page.
* **Immediately**, when you create or update a justification rule.

Rule **deletion** is the one gap: it does not enqueue a pass. Nothing about existing scripts changes on deletion anyway, so this only matters if you are waiting to see the effect.

## Force a refresh [#force-a-refresh]

Go to **PCI DSS** > **Script inventory** and select **Refresh inventory**. Managers and above can do this.

Rate-limited to one request per 30 seconds per website. The work is queued rather than immediate, so expect a few minutes before the inventory settles.

Worth doing when you want newly observed scripts picked up before the next hourly pass, typically right after a deploy you want to verify. Not worth repeating.

## Pass outcomes [#pass-outcomes]

For every script observed on a page matching an **enabled** payment-page pattern:

| Situation                              | Result                                                                                                       |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| Not seen before, no rule matches       | Status `Unreviewed`, ledger entry `Script detected`                                                          |
| Not seen before, a rule matches        | Status `Justified` with the rule's text and tags, ledger `Script detected` plus `Justification rule applied` |
| Hash changed since it was justified    | Status `Needs review`, ledger `Script hash changed`                                                          |
| No longer matching any enabled pattern | Retired, ledger `Script left the payment-page scope`                                                         |
| Matching again after being retired     | Restored, ledger `Script returned to the payment-page scope`                                                 |

Retiring is not deleting. Status, justification, and history are all preserved, retired scripts stay in the evidence pack, and re-entering scope brings them back with their record intact.

Scripts injected by browser extensions are excluded throughout, so a visitor's password manager does not end up in your compliance scope.

## Next steps [#next-steps]

* [Payment pages](/en/docs/platform/features/pci-dss/payment-pages)
* [Justification rules](/en/docs/platform/features/pci-dss/justification-rules)
* [Script inventory](/en/docs/platform/features/script-inventory)