---
updatedAt: 2026-03-01T18:29:26.000Z
agentTools:
  siteIndex: https://techdocs.akamai.com/llms.txt
  projectIndex: https://techdocs.akamai.com/script-management/llms.txt
---

# Create a policy for testing

```c cURL
network="STAGING"
hostname="docsassociates.com"
propertyId=6IJKL7
hostnames={hostname}

egcurl --eg-section default --request POST \
  --url "https://$hostname/script-management/v1/properties/$propertyId/$hostnames/$hostname/network/$network/policies" \
  --header "Accept: application/json" \
  --header "Content-Type: application/json" \
  --data '
{
    "policyNote": "First version for testing",
    "spofConfig": {
        "spofEnabled": true,
        "advancedSettings": {
            "minSpofTimeoutInSecs": 6,
            "maxSpofTimeoutInSecs": 20
        }
    },
    "scriptConfig": [
        {
            "item": "https://docsassociates.com/main.min.js",
            "type": "URL",
            "action": "BLOCK"
        },
        {
            "item": "https://docsassociates.com/analytics.js",
            "type": "URL",
            "action": "DEFER"
        }
    ]
}'
```

```node Node
const EdgeGrid = require("akamai-edgegrid");
const os = require("os");
const edgercPath = os.homedir + "/.edgerc.txt";
const edgercSection = "default";
const eg = new EdgeGrid({
  path: edgercPath,
  section: edgercSection,
});

const network = "STAGING";
const hostname = "docsassociates.com";
const propertyId = 6IJKL7;

eg.auth({
  path: `/script-management/v1/properties/${propertyId}/hostnames/${hostname}/network/${network}/policies`,
  method: "POST",
  headers: {
    "Content-Type": "application/json",

    Accept: "application/json",
  },
  body: {
    policyNote: "First version for testing",
    spofConfig: {
      spofEnabled: true,
      advancedSettings: {
        minSpofTimeoutInSecs: 6,
        maxSpofTimeoutInSecs: 20,
      },
    },
    scriptConfig: [
      {
        item: "https://docsassociates.com/main.min.js",
        type: "URL",
        action: "BLOCK",
      },
      {
        item: "https://docsassociates.com/analytics.js",
        type: "URL",
        action: "DEFER",
      },
    ],
  },
});
eg.send(function (error, response, body) {
  console.log(JSON.stringify(JSON.parse(body), null, 2));
});
```

```python Python
import requests
import json
from akamai.edgegrid import EdgeGridAuth, EdgeRc
from urlparse import urljoin

edgerc = EdgeRc('~/.edgerc.txt')
section = 'default'
baseurl = 'https://%s' % edgerc.get(section, 'host')

session = requests.Session()
session.auth = EdgeGridAuth.from_edgerc(edgerc, section)
network = "STAGING"
hostname = "docsassociates.com"
propertyId = 6IJKL7
 

path = '/script-management/v1/properties/{}/hostnames/{}/network/{}/policies'.format(propertyId, hostname, network)
headers = {
  "Content-Type": "application/json",

  "Accept": "application/json"}
payload = {
    "policyNote": "First version for testing",
    "spofConfig": {
        "spofEnabled": true,
        "advancedSettings": {
            "minSpofTimeoutInSecs": 6,
            "maxSpofTimeoutInSecs": 20
        }
    },
    "scriptConfig": [
        {
            "item": "https://docsassociates.com/main.min.js",
            "type": "URL",
            "action": "BLOCK"
        },
        {
            "item": "https://docsassociates.com/analytics.js",
            "type": "URL",
            "action": "DEFER"
        }
    ]
}  

result = session.post(urljoin(baseurl, path), headers=headers, json=payload)
print(result.status_code)
print(json.dumps(result.json(), indent=2)) 
```

```json Response Example
{
  "versionId": "1",
  "activationTime": "2023-02-19T09:45:00.000Z",
  "policyNote": "First version for testing",
  "spofConfig": {
    "spofEnabled": true,
    "advancedSettings": {
      "minSpofTimeoutInSecs": 6,
      "maxSpofTimeoutInSecs": 20
    }
  },
  "scriptConfig": [
    {
      "item": "https://docsassociates.com/main.min.js",
      "type": "URL",
      "action": "BLOCK"
    },
    {
      "item": "https://docsassociates.com/analytics.js",
      "type": "URL",
      "action": "DEFER"
    }
  ]
}
```

# Set up authentication

<!-- c@4-6 -->
<!-- node@1-8 -->
<!-- python@1-11 -->

If you haven't already, you need to [create your authentication credentials](https://techdocs.akamai.com/developer/docs/set-up-authentication-credentials) with READ/WRITE access to Script Management in an API client. Once you have, include this code to apply the token values to authenticate your requests.

**Note**: If you're using cURL, the `host` value from your authentication credential serves as the `hostnames={hostname}` variable value.

# Get your propertyId

<!-- c@0 -->
<!-- node@0 -->
<!-- python@0 -->

If you haven't stored this value, run the [list properties](https://techdocs.akamai.com/property-mgr/reference/get-properties) operation in PAPI. Locate the applicable Ion property based on its `propertyName` and store the associated `propertyId`.

# Get your property hostname

<!-- c@0 -->
<!-- node@0 -->
<!-- python@0 -->

Run the [list hostnames for a property](https://techdocs.akamai.com/property-mgr/reference/get-property-version-hostnames) operation in PAPI, using the stored `propertyId` value. 

Store the `cnameFrom` value from the response that represents the property hostname you want to use. (Typically, this is the domain that clients use to access your site or app.)

# Form the request URL

<!-- c@6 -->
<!-- node@15 -->
<!-- python@17 -->

Specify the target endpoint.

# Set property values

<!-- c@1-3 -->
<!-- node@10-12 -->
<!-- python@12-14 -->

You need to specify values for the Ion property that's using Script Management to deliver your site or app:

* `propertyId`. This is the unique identifier for the property that you stored (step 2).

* `hostname`. The property hostname that you stored (step 3).

* `network`. Ensure this is set to `STAGING` to test the policy on the ​​Akamai​​ staging network.

# Set your headers

<!-- c@8-9 -->
<!-- node@17-21 -->
<!-- python@18-21 -->

Include these headers:

* `Accept: application/json`
* `Content-Type: application/json`

# Build a POST object

<!-- c@11-32 -->
<!-- node@22-43 -->
<!-- python@22-43 -->

Build out this object to tell Script Management how to handle the scripts on your site or app. 

**Target a specific script**

Include the `scriptConfig` array and set its objects as follows:

* `item`. Enter a fully qualified URL for the script on your site.
* `type`. Set this to `URL`.
* `action`. How Script Management handles the specified script. A value of `DEFER` executes the script after the page load event. `BLOCK` prevents the script from loading entirely. `NO_ACTION` loads the script normally.

**Set up single point of failure protection**

Include the `spofConfig` object to move a call for any of your scripts to the background if they're taking too long to load. Set its parameters as follows:

* `spofEnabled`. Set this to `true` to enable this protection.
* `advancedSettings`. Use this array to set the `minSpofTimeoutInSecs` to the lower limit of the timeout range in seconds, and the `maxSpofTimeoutInSecs` to the upper limit.

***Note***: *Each Script Management policy needs a `spofConfig` or at least one `scriptConfig` array item.*

**Set a note for the policy (optional)**

Include the `policyNote` parameter with a string of text if you'd like to set a note for the policy.

# Call the API

<!-- c@1-1000 -->
<!-- node@1-1000 -->
<!-- python@1-1000 -->

Call POST on the request URL, providing the body request object.

# View the response

<!-- c@0 -->
<!-- node@0 -->
<!-- python@0 -->

The response includes all of the settings you've applied for the policy.