# Overview (/en/docs/web-security/reporting-api/get-started)



This section takes you from nothing to a working reporting endpoint: declare an
endpoint with the `Reporting-Endpoints` header, route a policy to it, and confirm a
report lands. Start in Report-Only so nothing breaks while you learn.

## Prerequisites [#prerequisites]

You need three things before you start:

* **An HTTPS site.** The browser only delivers reports to a secure (HTTPS) endpoint
  and silently ignores a non-secure one.
* **The ability to set response headers.** Reporting is configured entirely through
  headers, so you need access to your server, framework, or CDN config.
* **An endpoint URL to receive the reports.** This is any URL that accepts an HTTP
  `POST`. CentralCSP gives you a ready one, or you can use your own.

## In this section [#in-this-section]

<Cards>
  <Card title="Quickstart" href="/en/docs/web-security/reporting-api/get-started/quickstart" description="The three steps to your first report." />

  <Card title="Choose an endpoint" href="/en/docs/web-security/reporting-api/get-started/choose-an-endpoint" description="Where reports go, and build vs buy." />
</Cards>

## Next steps [#next-steps]

* Follow the end-to-end walkthrough in [how to set up the Reporting API](/en/blog/how-to-set-up-the-reporting-api).
* Understand the delivery format in [how the Reporting API works](/en/docs/web-security/reporting-api/concepts/how-the-reporting-api-works).
* Wire each policy: [Content Security Policy](/en/docs/web-security/policies/content-security-policy), [COOP](/en/docs/web-security/policies/cross-origin-opener-policy), [NEL](/en/docs/web-security/policies/network-error-logging).

## Sources [#sources]

* [MDN, Reporting-Endpoints header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Reporting-Endpoints)
* [Chrome, the Reporting API](https://developer.chrome.com/docs/capabilities/web-apis/reporting-api)