# COEP report (/en/docs/web-security/reporting-api/reports/coep)



A `coep` report tells you that [Cross-Origin-Embedder-Policy (COEP)](/en/docs/web-security/policies/cross-origin-embedder-policy) blocked, or would block, a cross-origin resource that did not explicitly opt in. It is how you
find every embed that would break before you turn COEP on, which matters because
COEP is a prerequisite for cross-origin isolation.

<Callout type="info" title="Limited availability">
  COEP is standardized, but reporting support is uneven across browsers. Verify support before relying on the report stream.
</Callout>

## When the browser sends it [#when-the-browser-sends-it]

When a `require-corp` (or `credentialless`) document loads a cross-origin subresource
that does not send a matching [`Cross-Origin-Resource-Policy`](/en/docs/web-security/security-headers/cross-origin-resource-policy) or pass CORS, or embeds
a frame or worker without matching COEP. In `Cross-Origin-Embedder-Policy-Report-Only`
mode the browser reports the would-be block without actually blocking, which is how
you size the impact before enforcing.

## Payload example [#payload-example]

```json
{
  "type": "coep",
  "age": 14,
  "url": "https://example.com/",
  "user_agent": "Mozilla/5.0 ...",
  "body": {
    "type": "corp",
    "blockedURL": "https://another-example.com/image.png",
    "destination": "image",
    "disposition": "enforce"
  }
}
```

Every `coep` report body carries these fields inside the shared report envelope.

## Field reference [#field-reference]

| Field         | Meaning                                                          |
| ------------- | ---------------------------------------------------------------- |
| `type`        | The cause: `corp`, `navigation`, or `worker initialization`.     |
| `blockedURL`  | The cross-origin resource that was blocked.                      |
| `destination` | The request destination, for example `image`, `script`, `frame`. |
| `disposition` | `enforce`, or `report` in Report-Only mode.                      |

## How to receive it [#how-to-receive-it]

Add a `report-to="..."` parameter to the COEP header and declare that endpoint in
[`Reporting-Endpoints`](/en/docs/web-security/reporting-api/headers/reporting-endpoints). Use `Cross-Origin-Embedder-Policy-Report-Only` for a dry run
first. CentralCSP collects the [coep stream](/en/docs/platform/monitoring/coep).

```http
Reporting-Endpoints: coep-endpoint="https://<Endpoint-ID>.report.centralcsp.com"
```

```http
Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="coep-endpoint"
```

## What it tells you about security [#what-it-tells-you-about-security]

Each report is a cross-origin resource that crosses the embedding boundary without
opting in. Reviewing them before you enforce both prevents breakage and tightens the
page against cross-origin data leaks, which is the point of COEP and of cross-origin
isolation.

## Gotchas [#gotchas]

The `disposition` field reflects whether COEP was enforcing or running in Report-Only
mode. The exact string is not fully consistent across sources: the spec enum is
`enforce` / `report`, while some browser documentation shows `reporting`. Read it as
the enforce-versus-report signal rather than matching one fixed literal, and confirm
against a live capture from your own traffic.

## Browser support [#browser-support]

COEP is defined in the HTML Living Standard and `require-corp` is broadly supported,
but the report delivery is Chromium-led, and the `credentialless` value is not
supported in Safari.

## See also [#see-also]

* [Cross-Origin-Embedder-Policy (COEP)](/en/docs/web-security/policies/cross-origin-embedder-policy)
* [coop report](/en/docs/web-security/reporting-api/reports/coop)
* [COEP monitoring in CentralCSP](/en/docs/platform/monitoring/coep)
* [Reporting-Endpoints header](/en/docs/web-security/reporting-api/headers/reporting-endpoints)
* [The report delivery format](/en/docs/web-security/reporting-api/concepts/report-delivery-format)

## Sources [#sources]

* [MDN, COEPViolationReport](https://developer.mozilla.org/en-US/docs/Web/API/COEPViolationReport)
* [MDN, Cross-Origin-Embedder-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy)