# Quickstart (/en/docs/web-security/reporting-api/get-started/quickstart)



The fastest path to a working setup is three steps: declare an endpoint, point a
policy at it in Report-Only, and confirm a report arrives.

## 1. Declare a reporting endpoint [#1-declare-a-reporting-endpoint]

Add the `Reporting-Endpoints` response header with a named endpoint.

```http
Reporting-Endpoints: main-endpoint="https://<Endpoint-ID>.report.centralcsp.com"
```

The name (`main-endpoint`) is arbitrary; a policy references it by that name. The
URL must be HTTPS, because the browser silently ignores a non-secure endpoint. You
can declare several names in one header, and a special endpoint named `default`
catches report types that have no explicit target (deprecations, interventions,
crashes).

## 2. Point a policy at the endpoint [#2-point-a-policy-at-the-endpoint]

Reference the named endpoint from a policy. Use Content Security Policy (CSP) in
Report-Only so it cannot break the site while you test.

```http
Reporting-Endpoints: main-endpoint="https://<Endpoint-ID>.report.centralcsp.com"
```

```http
Content-Security-Policy-Report-Only: default-src 'self'; report-to main-endpoint
```

## 3. Confirm a report arrives [#3-confirm-a-report-arrives]

Trigger a violation, the simplest is to load a script or style the policy does not
allow, then watch your endpoint. The browser sends an HTTP `POST` with
`Content-Type: application/reports+json`. Do not expect it instantly: Chromium
batches delivery and can delay it up to about a minute. To verify the setup without
building a receiver first, use the
[Reporting API configuration checker](/tools/reporting-api).

## Next steps [#next-steps]

* Decide where reports go in [choose an endpoint](/en/docs/web-security/reporting-api/get-started/choose-an-endpoint).
* Read what arrives in [the report delivery format](/en/docs/web-security/reporting-api/concepts/report-delivery-format).
* Browse [every report type](/en/docs/web-security/reporting-api/reports).

## Sources [#sources]

* [MDN, Reporting-Endpoints header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Reporting-Endpoints)
* [Chrome, the Reporting API](https://developer.chrome.com/docs/capabilities/web-apis/reporting-api)