Quickstart
Declare a reporting endpoint, point a Content Security Policy at it in report-only, and confirm the browser delivers a first report.
Last update:
The fastest path to a working setup is three steps: declare an endpoint, point a policy at it in Report-Only, and confirm a report arrives.
1. Declare a reporting endpoint
Add the Reporting-Endpoints response header with a named endpoint.
Reporting-Endpoints: main-endpoint="https://<Endpoint-ID>.report.centralcsp.com"The name (main-endpoint) is arbitrary; a policy references it by that name. The
URL must be HTTPS, because the browser silently ignores a non-secure endpoint. You
can declare several names in one header, and a special endpoint named default
catches report types that have no explicit target (deprecations, interventions,
crashes).
2. Point a policy at the endpoint
Reference the named endpoint from a policy. Use Content Security Policy (CSP) in Report-Only so it cannot break the site while you test.
Reporting-Endpoints: main-endpoint="https://<Endpoint-ID>.report.centralcsp.com"Content-Security-Policy-Report-Only: default-src 'self'; report-to main-endpoint3. Confirm a report arrives
Trigger a violation, the simplest is to load a script or style the policy does not
allow, then watch your endpoint. The browser sends an HTTP POST with
Content-Type: application/reports+json. Do not expect it instantly: Chromium
batches delivery and can delay it up to about a minute. To verify the setup without
building a receiver first, use the
Reporting API configuration checker.
Next steps
- Decide where reports go in choose an endpoint.
- Read what arrives in the report delivery format.
- Browse every report type.