permissions-policy-violation report, payload and fields

The permissions-policy-violation report fires when the page uses a feature that Permissions-Policy disallows.

A permissions-policy-violation report tells you the page tried to use a browser feature that Permissions-Policy does not allow in that context, for example geolocation or camera in a frame where it is disabled. It names the feature and where the call came from, so you can see what would break before you tighten the policy.

Experimental

Permissions-Policy reporting is not Baseline and is Chromium-led. The report body also differs from the spec (see Gotchas).

When the browser sends it

When code uses a feature that the policy gates off in the current context, the top document or an iframe where it is disallowed. Run Permissions-Policy-Report-Only to observe which features would be blocked before you enforce, so you do not break a legitimate use.

Payload example

{
  "type": "permissions-policy-violation",
  "age": 41,
  "url": "https://api-next.centralcsp.com/",
  "user_agent": "Mozilla/5.0 ...",
  "body": {
    "policyId": "geolocation",
    "sourceFile": "https://api-next.centralcsp.com/app.js",
    "lineNumber": 44,
    "columnNumber": 29,
    "disposition": "enforce",
    "message": "Permissions policy violation: geolocation has been blocked."
  }
}

Every permissions-policy-violation report body carries these fields inside the shared report envelope.

Field reference

Field	Meaning
`policyId`	The feature that was used, for example `geolocation`, `camera`.
`sourceFile`	The file that used the feature.
`lineNumber` / `columnNumber`	The location in that file.
`disposition`	`enforce`, or `report` in Report-Only mode.
`message`	A human-readable description of the violation.

How to receive it

Add a per-directive report-to= parameter on the Permissions-Policy header and declare that endpoint in Reporting-Endpoints. CentralCSP collects the permissions-policy stream.

Reporting-Endpoints: pp-endpoint="https://<Endpoint-ID>.report.centralcsp.com"

Permissions-Policy: geolocation=();report-to=pp-endpoint

What it tells you about security

These violations reveal code, often a third-party frame or script, reaching for a powerful feature it should not have: camera, microphone, geolocation, payment. That is both a privacy signal and an attack-surface signal, and the report names exactly which feature and which source so you can scope the policy precisely.

Gotchas

The POSTed report names the feature as policyId. The in-browser ReportingObserver interface, PermissionsPolicyViolationReport, exposes the same value as featureId, so an endpoint reading received reports should key on policyId while browser-side code reads featureId. Chromium also emits a separate potential-permissions-policy-violation type.

Browser support

Chromium-based browsers only for the report itself. The Permissions-Policy header is itself Chromium-only; Firefox and Safari support only the iframe allow attribute model for some features, so treat the report as a Chromium-first signal.

Permissions-Policy violation