# The report delivery format (/en/docs/web-security/reporting-api/concepts/report-delivery-format)



When the browser delivers reports, it sends an HTTP `POST` with
`Content-Type: application/reports+json` and a JSON array of report objects. Every
report shares the same outer envelope; only the `body` changes per type. This page
is the reference for that envelope, and for the older single-object format that
`report-uri` still uses.

## The request [#the-request]

Reports arrive as a `POST` whose body is a JSON **array**, not a single object,
even when there is only one report. A single delivery can batch several reports
together, and they do not have to be the same type: a CSP violation and a
deprecation can share one `POST` if they are queued for the same endpoint. Your
receiver should iterate the array and branch on each entry's `type`.

## The envelope fields [#the-envelope-fields]

Every entry in the array has the same five top-level fields. Only `body` differs
from one report type to the next.

| Field        | Meaning                                                                                                                            |
| ------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
| `type`       | The report category, for example `csp-violation`, `deprecation`, `network-error`.                                                  |
| `url`        | The document the report came from, stripped of credentials and fragment.                                                           |
| `user_agent` | The User-Agent string of the page that generated the report.                                                                       |
| `age`        | Milliseconds between when the report was generated and when it was sent, so you can correct for the batching delay and clock skew. |
| `body`       | The type-specific payload (the fields documented on each report page).                                                             |

```json
[
  {
    "type": "csp-violation",
    "age": 53,
    "url": "https://example.com/",
    "user_agent": "Mozilla/5.0 ...",
    "body": {
      "documentURL": "https://example.com/",
      "blockedURL": "https://evil.example/script.js",
      "effectiveDirective": "script-src-elem",
      "disposition": "enforce",
      "statusCode": 200
    }
  }
]
```

## Modern format vs the legacy csp-report format [#modern-format-vs-the-legacy-csp-report-format]

<Callout type="info">
  The Reporting API uses camelCase body fields (`documentURL`, `blockedURL`); the legacy `report-uri` format uses a single object wrapped in `csp-report` with kebab-case fields (`document-uri`, `blocked-uri`) and `Content-Type: application/csp-report`. An endpoint that accepts both must branch on the `Content-Type`.
</Callout>

The legacy format predates the Reporting API and is specific to CSP. It is a single
object, not an array, it has no envelope (no `type`, `age`, or `user_agent`), and its
field names are kebab-case:

```json
{
  "csp-report": {
    "document-uri": "https://example.com/",
    "blocked-uri": "https://evil.example/script.js",
    "effective-directive": "script-src-elem",
    "original-policy": "default-src 'self'; report-uri /csp-reports",
    "disposition": "enforce",
    "status-code": 200
  }
}
```

So a receiver that supports both reads the `Content-Type`: `application/reports+json`
means the modern array, `application/csp-report` means the legacy object. The
[`csp-violation` report](/en/docs/web-security/reporting-api/reports/csp-violation) page documents
both shapes field by field.

## See also [#see-also]

* [csp-violation report](/en/docs/web-security/reporting-api/reports/csp-violation)
* [How the Reporting API works](/en/docs/web-security/reporting-api/concepts/how-the-reporting-api-works)
* [Reporting-Endpoints header](/en/docs/web-security/reporting-api/headers/reporting-endpoints)
* [Where browser reports go and how to receive them](/en/blog/where-to-send-csp-reports)

## Sources [#sources]

* [W3C, Reporting API](https://www.w3.org/TR/reporting-1/)
* [MDN, CSPViolationReportBody](https://developer.mozilla.org/en-US/docs/Web/API/CSPViolationReportBody)
* [MDN, CSP report-uri](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/report-uri)