Custom subdomain

Replace the random endpoint hostname with a name you choose. CentralCSP creates the DNS record, you update your headers afterwards.

Every website gets a randomly generated endpoint hostname when you create it. Claiming a subdomain swaps that for a label you choose, so your headers read acme.report.centralcsp.com instead of a string of hex.

This is cosmetic and organizational. It changes nothing about how reports are collected or attributed.

Requirements

You need both of the following:

A plan that includes custom subdomains.
The website Manager role or higher.

Claim a subdomain

Claim a subdomain in four steps:

Open the website and go to Setup.
Under Reporting endpoint, select Claim subdomain.
Enter the label you want. This is the leftmost part of the hostname only, not a full domain.
Confirm.

There is no DNS work on your side and no verification step. CentralCSP owns the ingestion zone and creates the record itself.

Update your headers afterwards

Claiming a subdomain does not rewrite your site's headers. Your old endpoint URL stops being the one shown on Setup, so copy the new header block and deploy it. Until you do, reports keep flowing to the old hostname.

The new record is created before the old one is removed, so the endpoint stays resolvable throughout. There is no window where reports are dropped.

The dialog takes a single label:

The Claim a subdomain dialog, with a single label typed into the Subdomain field

Naming rules

A label must be:

1 to 63 characters
lowercase letters, digits, and hyphens only
not starting or ending with a hyphen

A 21-character hexadecimal string is rejected. That shape is reserved for the hostnames CentralCSP assigns automatically, and allowing it would let a claim collide with a future auto-assignment.

Rate limits

Changes are capped before any work happens:

3 changes per website per day
10 changes per workspace per day

Both windows are rolling 24 hours. Pick a name you intend to keep rather than iterating.

When a name is unavailable

Two different refusals, with different meanings:

Already claimed: Another website holds it. Names are unique across all of CentralCSP, not just your workspace.
Quarantined: Someone released it recently and it is being held. The error tells you the date it becomes available again.

Your own workspace can always re-claim a hostname it previously held, so switching back after a mistake is not blocked by quarantine.

The old subdomain

The hostname you leave behind is quarantined for 90 days before anyone else can claim it. This matches the report retention window, for the same reason. A browser that cached your Reporting-Endpoints header keeps posting to the old URL for a while. Handing that hostname to a different customer inside that window would send them your reports.

Plan around it. If you are cycling through names in a test workspace, each discarded one is out of circulation for a quarter.