---
name: grr-script
description: "Use when the task touches Apps Script through grr (16 methods under `grr script` — projects, processes, scripts). Carries the service's generated command map, the naming rule applied to script, example commands verified with --dry-run, and the least-privilege scope callout."
---
<!-- GENERATED by scripts/generate-skills.ts from the committed Discovery index — index generated at 2026-10-19T09:53:20.114Z. Do not edit by hand; regenerate with `npm run skills`. -->
# grr script — Apps Script API
**16 methods**, v1, Discovery revision 20261005, all reached as `grr script <resource…> <method>` and generated from the same committed index as the CLI tree — this file, `grr api`, and `grr script --help` never disagree. Load the core skill first: [grr](../grr/SKILL.md) owns the discovery discipline, the output contract, the safety flags, multi-account, `mcp`, and `ask`.
## Coverage
| Resource path (the id prefix — each command walks these words) | Methods |
| --- | --- |
| `projects` | 5 |
| `projects.deployments` | 5 |
| `projects.versions` | 3 |
| `processes` | 2 |
| `scripts` | 1 |
## Naming, applied to script
- Id dots become spaces: `script.projects.deployments.list` → `grr script projects deployments list`. Resource segments and method names keep their exact Discovery casing (`otherContacts`, `getProfile`).
- Flags are the same ids, camelCase → kebab-case: `userId` → `--user-id`, `maxResults` → `--max-results`. Integers parse as numbers, booleans are presence flags, repeated parameters repeat, enum parameters validate.
- No parameter in this service collides with the reserved flag names (`params`, `body-file`, `query`, `dry-run`, `format`).
- Request bodies are untyped by design: `--params '<json>'` or `--body-file PATH|-`. Typed flags win on conflict.
## Examples
```sh
grr script projects deployments list --script-id <script-id> --page-size 10
grr script projects get --script-id <script-id>
grr script projects create --dry-run
```
Values in `<angle brackets>` are placeholders — substitute real ids (`me` is the authenticated user wherever the parameter is `--user-id`). Append `--dry-run` to any example to print the resolved request — verb, URL, scopes — instead of sending it.
## Scopes
- Least privilege for reads: `https://www.googleapis.com/auth/script.projects.readonly` — the narrowest scope the service's methods accept (it is the least-privilege scope for 4 of 16 methods). Per method, ask the index: `grr api describe <id>` → `leastPrivilegeScope`.
- Scope honesty: a login grants only the scopes it asked for — `grr auth login` requests a small default set, `--service <name>` adds one service's scopes from the embedded index, `--all-scopes` the whole union — minus the Chat app-authentication scopes Google grants only to a service account (`chat.bot`, `chat.app.*`, `chat.import`), which a user consent screen cannot show. A `403` is therefore not a missing consent: it is either a scope outside the current grant (the remedy is a human re-running `grr auth login --service <name>`) or an API that is not enabled on the Cloud project. Surface that distinction; never retry a 403 in a loop.
## Contract
- stdout is data, stderr is logs; JSON by default, `-f jsonl|table|pretty` to switch.
- `--dry-run` before anything destructive — the resolved request as JSON, nothing sent.
- Non-zero exit on failure; errors are actionable (a 403 names the missing scope, a typo gets ranked suggestions).
## Go deeper
- Core skill: [skills/grr/SKILL.md](../grr/SKILL.md) — discipline, contract, safety, accounts.
- `grr api describe script.projects.deployments.list` — the authority on one method's parameters and scopes.
- `grr api list --service script` and `grr script --help` — browse the whole branch, offline, before any login.
- Site reference: [grr-cli.pages.dev/docs/api-reference/script/](https://grr-cli.pages.dev/docs/api-reference/script/)