Reporting API headers, Reporting-Endpoints and Report-To
Declare reporting endpoints and route browser reports to them with Reporting-Endpoints and the legacy Report-To.
Last update:
These headers tell the browser where to send reports. You declare one or more
named endpoints, then a policy references an endpoint by name to route its reports
there. The modern header is Reporting-Endpoints; Report-To is the legacy form,
kept mainly for Network Error Logging.
Reporting-Endpoints: default="https://<Endpoint-ID>.report.centralcsp.com"Pages in this section
Reporting-Endpoints
The modern header (recommended).
Report-To
The legacy header (deprecated, still required for NEL).
How a policy points at an endpoint
A header only declares the endpoints. A policy then references one by name, and each policy has its own syntax for doing so:
- CSP uses the
report-todirective:report-to csp-endpoint. - COOP, COEP, and Permissions-Policy use a
report-to=parameter on their header, for exampleCross-Origin-Opener-Policy: same-origin; report-to="coop-endpoint". - Integrity-Policy uses an
endpoints=()directive. - The implicit report types (deprecation, intervention, crash) have no per-policy
syntax; they go to the endpoint named
default.
Whichever syntax a policy uses, the name has to match one declared by
Reporting-Endpoints (or Report-To) on the same response, or the reports go
nowhere. See Policies for each one.
Next steps
- See how each policy points at an endpoint in Policies.
- Compare the two headers in Report-To vs Reporting-Endpoints.
The default reporting endpoint
The default endpoint in Reporting-Endpoints catches report types with no explicit target, including deprecation, intervention, and crash reports.
Reporting-Endpoints header
The modern header that declares named reporting endpoints for CSP, COOP, COEP, and other browser policies.