Confused by various apis scriptPubKey
These are API names and display scripts in their encoded and or decoded form. What you want to build a transaction is the encoded form like the one returned by toshi (script_hex) or smartbit (hex).

A script is a sequence of instructions beginning by OP_ (OP_DUP, etc...) and hex data. You can read more about the Script language here.

At the protocol level, all of the instructions and data are concatenated to form a single (encoded) hex blob of the script: 

76a914cba5f746dc1e41a932a7d38be7aba95944619ee888ac


This is what is signed by the transaction builder. However, it's not really intelligible for us humans. That's why these APIs decode the hex into the sequence of instructions they encode:

OP_DUP (0x76)
OP_HASH160 (0xa9)
(0x14 means 20 bytes of data are next)
cba5f746dc1e41a932a7d38be7aba95944619ee8
OP_EQUALVERIFY (0x88)
OP_CHECKSIG (0xac)


The traditional way of showing this decoded script is :

OP_DUP OP_HASH160 cba5f746dc1e41a932a7d38be7aba95944619ee8 OP_EQUALVERIFY OP_CHECKSIG