# The default reporting endpoint (/en/docs/web-security/reporting-api/concepts/default-endpoint)



`default` is the special endpoint name in the
[`Reporting-Endpoints`](/en/docs/web-security/reporting-api/headers/reporting-endpoints) header that
catches report types the browser has nowhere else to send. Several report types are not
tied to a per-policy directive, so they have no named endpoint to reference. The browser
routes those to the endpoint you call `default`, and to nothing if you have not declared
one.

## What goes to the default endpoint [#what-goes-to-the-default-endpoint]

Some reports come from a policy that names its own endpoint (for example CSP names one
with its `report-to` directive). Others are emitted by the browser itself, with no
directive to point them anywhere. Those fall back to `default`:

* [`deprecation` reports](/en/docs/web-security/reporting-api/reports/deprecation), emitted when the
  page uses a web feature scheduled for removal.
* [`intervention` reports](/en/docs/web-security/reporting-api/reports/intervention), emitted when
  the browser refuses or alters something the page asked for.
* [`crash` reports](/en/docs/web-security/reporting-api/reports/crash), emitted when the document
  crashes.

Any report whose type has no matching named endpoint is delivered to `default` as
well. If `default` is not declared, those reports are dropped. See the full list on the
[reports](/en/docs/web-security/reporting-api/reports) page.

## Named endpoints do not catch these [#named-endpoints-do-not-catch-these]

This is the part that trips people up. A named endpoint such as `csp-endpoint` only
receives reports from a policy that explicitly references it. It does not act as a
catch-all. If you declare only a named endpoint and no `default`, your deprecation,
intervention, and crash reports have nowhere to go and never arrive, with no error
anywhere.

If your deprecation, intervention, or crash reports never show up, the usual cause is a
missing `default` endpoint. Named endpoints only catch what a policy points at them.

```mermaid
flowchart TD
  A["Report generated"] --> B{"Names an endpoint?"}
  B -->|"yes, matching named endpoint"| C["Delivered to that endpoint"]
  B -->|"no named target"| D{"default declared?"}
  D -->|yes| E["Delivered to default"]
  D -->|no| F["Dropped, no error"]
```

## A minimal example [#a-minimal-example]

Declare both a named endpoint for your policy and a `default` for everything else. Each
maps a name to an HTTPS URL.

```http
Reporting-Endpoints: csp-endpoint="https://<Endpoint-ID>.report.centralcsp.com",
                     default="https://<Endpoint-ID>.report.centralcsp.com"
```

The two URLs can be the same or different. Point `default` at a separate URL if you want
to keep browser-emitted reports out of your CSP stream, or reuse one URL to collect
everything together. To confirm a live site routes both correctly without building a
receiver, use the
[Reporting API configuration checker](/tools/reporting-api), and to collect and
aggregate every report type without standing up a backend, point the endpoints at
[CentralCSP reporting](/platform/monitoring). The end-to-end setup is in
[how to set up the Reporting API](/en/blog/how-to-set-up-the-reporting-api).

## See also [#see-also]

* [Reporting-Endpoints header](/en/docs/web-security/reporting-api/headers/reporting-endpoints)
* [Reports](/en/docs/web-security/reporting-api/reports)
* [Deprecation report](/en/docs/web-security/reporting-api/reports/deprecation)
* [Intervention report](/en/docs/web-security/reporting-api/reports/intervention)
* [Crash report](/en/docs/web-security/reporting-api/reports/crash)

## Sources [#sources]

* [MDN, Reporting-Endpoints header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Reporting-Endpoints)
* [W3C, Reporting API](https://www.w3.org/TR/reporting-1/)