# Overview (/en/docs/web-security/reporting-api/headers)



These headers tell the browser where to send reports. You declare one or more
named endpoints, then a policy references an endpoint by name to route its reports
there. The modern header is `Reporting-Endpoints`; `Report-To` is the legacy form,
kept mainly for Network Error Logging.

```http
Reporting-Endpoints: default="https://<Endpoint-ID>.report.centralcsp.com"
```

## Pages in this section [#pages-in-this-section]

<Cards>
  <Card title="Reporting-Endpoints" href="/en/docs/web-security/reporting-api/headers/reporting-endpoints" description="The modern header (recommended)." />

  <Card title="Report-To" href="/en/docs/web-security/reporting-api/headers/report-to" description="The legacy header (deprecated, still required for NEL)." />
</Cards>

## How a policy points at an endpoint [#how-a-policy-points-at-an-endpoint]

A header only declares the endpoints. A policy then references one by name, and each
policy has its own syntax for doing so:

* **CSP** uses the `report-to` directive: `report-to csp-endpoint`.
* **COOP, COEP, and Permissions-Policy** use a `report-to=` parameter on their
  header, for example `Cross-Origin-Opener-Policy: same-origin; report-to="coop-endpoint"`.
* **Integrity-Policy** uses an `endpoints=()` directive.
* The implicit report types (**deprecation, intervention, crash**) have no per-policy
  syntax; they go to the endpoint named `default`.

Whichever syntax a policy uses, the name has to match one declared by
`Reporting-Endpoints` (or `Report-To`) on the same response, or the reports go
nowhere. See [Policies](/en/docs/web-security/policies) for each one.

## Next steps [#next-steps]

* See how each policy points at an endpoint in [Policies](/en/docs/web-security/policies).
* Compare the two headers in [Report-To vs Reporting-Endpoints](/en/docs/web-security/reporting-api/concepts/report-to-vs-reporting-endpoints).