API is the requested URL directly. Script is whatever is defined and executed within DreamFactory.
For example, lets say I have a table XYZ. If I want to access the table directly, I need to give it API access (whatever verbs you need). But, lets say I need to access it through a Custom Scripting Service as well, I need to give it API access (for direct access) plus Script access (so that the Scripting Service can call it).
Hope this makes sense.