# Deprecation (/en/docs/web-security/reporting-api/reports/deprecation)



A `deprecation` report tells you that the page used an API the browser has marked
for removal. It is an early-warning signal: you find out which code path relies on
a feature that will stop working, with a source location, before it breaks in a
future release.

<Callout type="warn" title="Non-standard">
  Deprecation reporting is not defined in a current specification and is implemented mainly in Chromium. Use it as a heads-up, not as a guaranteed cross-browser signal.
</Callout>

## When the browser sends it [#when-the-browser-sends-it]

When the page uses a deprecated API. The report goes to [the default reporting endpoint](/en/docs/web-security/reporting-api/concepts/default-endpoint)
in [`Reporting-Endpoints`](/en/docs/web-security/reporting-api/headers/reporting-endpoints) (it has no per-policy directive), and it is also observable
in the page through [`ReportingObserver`](/en/docs/web-security/reporting-api/concepts/reporting-observer),
which is useful for surfacing deprecations to developers during a build.

## Payload example [#payload-example]

```json
{
  "type": "deprecation",
  "age": 32,
  "url": "https://example.com/",
  "user_agent": "Mozilla/5.0 ...",
  "body": {
    "id": "XMLHttpRequestSynchronousInNonWorkerOutsideBeforeUnload",
    "message": "Synchronous XMLHttpRequest on the main thread is deprecated ...",
    "anticipatedRemoval": null,
    "sourceFile": "https://example.com/app.js",
    "lineNumber": 54,
    "columnNumber": 11
  }
}
```

Every `deprecation` report body carries these fields inside the shared report envelope.

## Field reference [#field-reference]

| Field                         | Meaning                                                            |
| ----------------------------- | ------------------------------------------------------------------ |
| `id`                          | A machine-readable feature identifier, the stable key to group by. |
| `message`                     | A human-readable description of the deprecation.                   |
| `anticipatedRemoval`          | The planned removal date, or `null` if not announced.              |
| `sourceFile`                  | The file that used the deprecated API.                             |
| `lineNumber` / `columnNumber` | The location in that file.                                         |

## How to receive it [#how-to-receive-it]

Declare a `default` endpoint in `Reporting-Endpoints`; deprecation reports have no
other target. CentralCSP collects them at
[one endpoint](/en/docs/platform/monitoring/deprecation) alongside every other type.

## What it tells you about security [#what-it-tells-you-about-security]

Deprecated APIs are often the ones with the weakest defaults (synchronous
`XMLHttpRequest`, legacy crypto, insecure patterns the platform is retiring).
Clearing them removes both a future breakage and, frequently, a security weakness,
so the report is worth acting on rather than filing.

## Gotchas [#gotchas]

`anticipatedRemoval` is frequently `null`, so do not rely on it for scheduling. The
`id` is the stable key to group and track by; the `message` wording can change
between browser versions.

## Browser support [#browser-support]

Chromium-based browsers only; not Baseline. Other engines do not emit deprecation
reports, so treat it as a Chromium-first signal.

## See also [#see-also]

* [ReportingObserver](/en/docs/web-security/reporting-api/concepts/reporting-observer)
* [intervention report](/en/docs/web-security/reporting-api/reports/intervention)
* [Deprecation and intervention reports](/en/blog/deprecation-intervention-reports)
* [Deprecation monitoring in CentralCSP](/en/docs/platform/monitoring/deprecation)
* [Reporting-Endpoints header](/en/docs/web-security/reporting-api/headers/reporting-endpoints)
* [The report delivery format](/en/docs/web-security/reporting-api/concepts/report-delivery-format)

## Sources [#sources]

* [MDN, DeprecationReport](https://developer.mozilla.org/en-US/docs/Web/API/DeprecationReport)
* [MDN, Reporting API](https://developer.mozilla.org/en-US/docs/Web/API/Reporting_API)