coep report, payload and fields

The coep report fires when Cross-Origin-Embedder-Policy blocks a cross-origin resource that did not opt in.

A coep report tells you that Cross-Origin-Embedder-Policy (COEP) blocked, or would block, a cross-origin resource that did not explicitly opt in. It is how you find every embed that would break before you turn COEP on, which matters because COEP is a prerequisite for cross-origin isolation.

Limited availability

COEP is standardized, but reporting support is uneven across browsers. Verify support before relying on the report stream.

When the browser sends it

When a require-corp (or credentialless) document loads a cross-origin subresource that does not send a matching Cross-Origin-Resource-Policy or pass CORS, or embeds a frame or worker without matching COEP. In Cross-Origin-Embedder-Policy-Report-Only mode the browser reports the would-be block without actually blocking, which is how you size the impact before enforcing.

Payload example

{
  "type": "coep",
  "age": 14,
  "url": "https://api-next.centralcsp.com/",
  "user_agent": "Mozilla/5.0 ...",
  "body": {
    "type": "corp",
    "blockedURL": "https://another-example.com/image.png",
    "destination": "image",
    "disposition": "enforce"
  }
}

Every coep report body carries these fields inside the shared report envelope.

Field reference

Field	Meaning
`type`	The cause: `corp`, `navigation`, or `worker initialization`.
`blockedURL`	The cross-origin resource that was blocked.
`destination`	The request destination, for example `image`, `script`, `frame`.
`disposition`	`enforce`, or `report` in Report-Only mode.

How to receive it

Add a report-to="..." parameter to the COEP header and declare that endpoint in Reporting-Endpoints. Use Cross-Origin-Embedder-Policy-Report-Only for a dry run first. CentralCSP collects the coep stream.

Reporting-Endpoints: coep-endpoint="https://<Endpoint-ID>.report.centralcsp.com"

Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="coep-endpoint"

What it tells you about security

Each report is a cross-origin resource that crosses the embedding boundary without opting in. Reviewing them before you enforce both prevents breakage and tightens the page against cross-origin data leaks, which is the point of COEP and of cross-origin isolation.

Gotchas

The disposition field reflects whether COEP was enforcing or running in Report-Only mode. The exact string is not fully consistent across sources: the spec enum is enforce / report, while some browser documentation shows reporting. Read it as the enforce-versus-report signal rather than matching one fixed literal, and confirm against a live capture from your own traffic.

Browser support

COEP is defined in the HTML Living Standard and require-corp is broadly supported, but the report delivery is Chromium-led, and the credentialless value is not supported in Safari.

COEP report