# Permissions-Policy violation (/en/docs/web-security/reporting-api/reports/permissions-policy-violation)



A `permissions-policy-violation` report tells you the page tried to use a browser
feature that [Permissions-Policy](/en/docs/web-security/policies/permissions-policy) does not allow in that context, for example
geolocation or camera in a frame where it is disabled. It names the feature and
where the call came from, so you can see what would break before you tighten the
policy.

<Callout type="warn" title="Experimental">
  Permissions-Policy reporting is not Baseline and is Chromium-led. The report `body` also differs from the spec (see Gotchas).
</Callout>

## When the browser sends it [#when-the-browser-sends-it]

When code uses a feature that the policy gates off in the current context, the top
document or an iframe where it is disallowed. Run `Permissions-Policy-Report-Only`
to observe which features would be blocked before you enforce, so you do not break a
legitimate use.

## Payload example [#payload-example]

```json
{
  "type": "permissions-policy-violation",
  "age": 41,
  "url": "https://example.com/",
  "user_agent": "Mozilla/5.0 ...",
  "body": {
    "policyId": "geolocation",
    "sourceFile": "https://example.com/app.js",
    "lineNumber": 44,
    "columnNumber": 29,
    "disposition": "enforce",
    "message": "Permissions policy violation: geolocation has been blocked."
  }
}
```

Every `permissions-policy-violation` report body carries these fields inside the shared report envelope.

## Field reference [#field-reference]

| Field                         | Meaning                                                         |
| ----------------------------- | --------------------------------------------------------------- |
| `policyId`                    | The feature that was used, for example `geolocation`, `camera`. |
| `sourceFile`                  | The file that used the feature.                                 |
| `lineNumber` / `columnNumber` | The location in that file.                                      |
| `disposition`                 | `enforce`, or `report` in Report-Only mode.                     |
| `message`                     | A human-readable description of the violation.                  |

## How to receive it [#how-to-receive-it]

Add a per-directive `report-to=` parameter on the `Permissions-Policy` header and
declare that endpoint in [`Reporting-Endpoints`](/en/docs/web-security/reporting-api/headers/reporting-endpoints). CentralCSP collects the
[permissions-policy stream](/en/docs/platform/monitoring/permissions-policy).

```http
Reporting-Endpoints: pp-endpoint="https://<Endpoint-ID>.report.centralcsp.com"
```

```http
Permissions-Policy: geolocation=();report-to=pp-endpoint
```

## What it tells you about security [#what-it-tells-you-about-security]

These violations reveal code, often a third-party frame or script, reaching for a
powerful feature it should not have: camera, microphone, geolocation, payment. That
is both a privacy signal and an attack-surface signal, and the report names exactly
which feature and which source so you can scope the policy precisely.

## Gotchas [#gotchas]

<Callout type="info">
  The POSTed report names the feature as `policyId`. The in-browser ReportingObserver interface, `PermissionsPolicyViolationReport`, exposes the same value as `featureId`, so an endpoint reading received reports should key on `policyId` while browser-side code reads `featureId`. Chromium also emits a separate `potential-permissions-policy-violation` type.
</Callout>

## Browser support [#browser-support]

Chromium-based browsers only for the report itself. The `Permissions-Policy` header
is itself Chromium-only; Firefox and Safari support only the iframe `allow`
attribute model for some features, so treat the report as a Chromium-first signal.

## See also [#see-also]

* [Permissions-Policy](/en/docs/web-security/policies/permissions-policy)
* [document-policy-violation report](/en/docs/web-security/reporting-api/reports/document-policy-violation)
* [Permissions-Policy explained](/en/blog/permissions-policy-explained)
* [Permissions-Policy monitoring in CentralCSP](/en/docs/platform/monitoring/permissions-policy)
* [Reporting-Endpoints header](/en/docs/web-security/reporting-api/headers/reporting-endpoints)
* [The report delivery format](/en/docs/web-security/reporting-api/concepts/report-delivery-format)

## Sources [#sources]

* [MDN, PermissionsPolicyViolationReport](https://developer.mozilla.org/en-US/docs/Web/API/PermissionsPolicyViolationReport)
* [MDN, Permissions-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy)