--- title: "CSP monitoring & Reporting API for developers" description: "Add one response header, no SDK, and debug CSP violations with source-level context. Inventory scripts, catch CVEs, automate over the REST API and MCP." url: "https://next.centralcsp.com/en/solutions/developers/" lang: "en" --- For developers # Ship the site. Keep the browser under watch. One response header collects CSP and browser security reports from your real traffic: violations to debug, alerts to act on. No agent, no SDK. Audit my website 1.5B reports ingested 12 report types collected 0 agents or SDKs to install 100% EU data residency The blind spot ## Your server tools stop at the response. Third-party scripts, injected code and policy violations execute in the browser, after the page leaves your infrastructure. CentralCSP collects the signal browsers already emit and routes it back to your stack. 01 - Browsers Native Reporting-API signals from your real production traffic. - csp-violation - deprecation - intervention - network-error - crash 02 - Endpoint Your managed reporting endpoint. MyEndpoint.report.centralcsp.com - Normalize and dedupe - Classify by report type and origin - Enrich with source context - Score and inventory 03 - Your stack The signal lands where you already work. - Live dashboard - REST API - MCP server ### Real production traffic Reports come from your actual visitors' browsers, not a crawler pointed at a staging URL. ### Source-level context Every violation keeps its source file, line, column, directive, browser and origin. ### Zero runtime dependency Nothing loads on your pages. Browsers report natively, so performance impact is zero. Setup ## One header. That's the integration. Ship it from the CDN, reverse proxy, framework or application layer, whichever you own. response header Reporting-Endpoints : default= "https://MyEndpoint.report.centralcsp.com" Have a CSP already? Point its report-to at the same endpoint and every violation lands there too. 1. 1 Add your site Create the site in your dashboard and copy its managed reporting endpoint. 2. 2 Ship the header Deploy from your edge or app. Reports flow from real visitor browsers immediately. 3. 3 Route the signal Watch the live dashboard, wire alerts to your channels, pull anything over the API. Free tools ## Try the full security toolkit. Six tools, no account required. The same engines the platform runs on. ### CSP scanner Map the headers, policy findings and reporting coverage of any public site. - Full header inventory - Findings ranked by severity - Results on a shareable page [Scan a site](https://next.centralcsp.com/en/tools/csp-scanner/) ### CSP evaluator Paste a policy and get prioritized findings with a clear score. - Directive-by-directive findings - A clear overall score - Powered by the platform engine [Evaluate a policy](https://next.centralcsp.com/en/tools/csp-evaluator/) ### Reporting-API checker See which reports a site actually collects, and where they are sent. - Endpoint and binding checks - Coverage per report type - Dropped-report warnings [Check your setup](https://next.centralcsp.com/en/tools/reporting-api/) ### Security headers scanner Audit the response headers of any public site and see what's missing. - Every header, graded - Fixes for what's missing - Rescan after you deploy [Scan security headers](https://next.centralcsp.com/en/tools/security-headers/) ### Security compare Scan your site live and see how it ranks against your industry. - Live scan of your site - Industry cohort comparison - Assess your maturity [Compare your site](https://next.centralcsp.com/en/tools/compare/) ### Chrome extension Watch live violations and build or test a policy against any page in your browser. - Live violation feed - Build and test policies in place - Works on the page you're viewing [Get the extension](https://next.centralcsp.com/en/tools/extension/) The dashboard ## Everything happens in one place. Reports, scores, inventories and evidence for every site you ship, behind one login. - Live reports from real visitors - Directive, browser and origin filters - Auditor-ready PCI evidence Automation ## Everything in the dashboard, over the API. Reports, inventories, scores and evidence are all queryable. Automate site onboarding, export everything, or let your AI agents drive it over MCP. - Full REST API with scoped tokens - Webhooks, CSV and raw-report exports - Built-in MCP server for AI agents - Alerts to Slack, Teams or any webhook [See the API and MCP platform](https://next.centralcsp.com/en/platform/api-mcp/) Past the code review ## Answers for the rest of the room. What compliance, security review and procurement will ask about, covered by the same platform. 1. 6.4.3 11.6.1 01 - Compliance ### PCI DSS evidence If your checkout is in scope, requirements 6.4.3 and 11.6.1 are covered from the same signal. 2. 02 - Security review ### Enterprise controls The controls your security review asks about, already in place. Data hosted in France, on OVH. 3. 03 - Access ### Team and access Bring the whole team without sharing one login, and scope who sees what. The signal ## Every report type browsers can send. One endpoint collects them all. Each type is parsed, deduped and searchable from day one. - `csp-violation` CSP violations A resource was blocked, or would be blocked, by your Content Security Policy. [View docs](https://next.centralcsp.com/en/docs/web-security/reporting-api/reports/csp-violation) - `csp-hash` Script hashes The hash of every script the page executes, the raw material for hash-based policies. [View docs](https://next.centralcsp.com/en/docs/web-security/reporting-api/reports/csp-hash) - `integrity-violation` Integrity violations A script failed its Subresource Integrity check under your Integrity-Policy. [View docs](https://next.centralcsp.com/en/docs/web-security/reporting-api/reports/integrity-violation) - `coop` COOP violations A cross-origin window interaction your Cross-Origin-Opener-Policy blocked or would block. [View docs](https://next.centralcsp.com/en/docs/web-security/reporting-api/reports/coop) - `coep` COEP violations A resource loaded without the opt-in your Cross-Origin-Embedder-Policy requires. [View docs](https://next.centralcsp.com/en/docs/web-security/reporting-api/reports/coep) - `document-policy-violation` Document Policy violations A page behavior that breaks the configuration your Document-Policy declares. [View docs](https://next.centralcsp.com/en/docs/web-security/reporting-api/reports/document-policy-violation) - `permissions-policy-violation` Permissions Policy violations A feature like camera or geolocation was used against your Permissions-Policy. [View docs](https://next.centralcsp.com/en/docs/web-security/reporting-api/reports/permissions-policy-violation) - `connection-allowlist` Connection Allowlist violations A connection left your page for an origin outside the allowlist you declared. [View docs](https://next.centralcsp.com/en/docs/web-security/reporting-api/reports/connection-allowlist) - `network-error` Network errors DNS, TLS and connection failures your server never sees, logged by the browser itself. [View docs](https://next.centralcsp.com/en/docs/web-security/reporting-api/reports/network-error) - `deprecation` Deprecations The page uses a browser API scheduled for removal, with the removal date when known. [View docs](https://next.centralcsp.com/en/docs/web-security/reporting-api/reports/deprecation) - `intervention` Interventions The browser changed your page's behavior itself, like blocking an autoplay or a slow script. [View docs](https://next.centralcsp.com/en/docs/web-security/reporting-api/reports/intervention) - `crash` Crashes The tab crashed or ran out of memory while a user was on your page. [View docs](https://next.centralcsp.com/en/docs/web-security/reporting-api/reports/crash) FAQ ## Frequently asked questions Implementation, safety and automation, answered. ### How long does it take to connect a site? One response header. Add it at your CDN, reverse proxy, framework, or application layer, and reports appear as real users browse. There is no JavaScript agent and no SDK to deploy. ### Can CentralCSP break my application? No. Collecting reports changes nothing about how your pages behave. For CSP work, start with Content-Security-Policy-Report-Only, review real violations, and enforce only when the policy runs clean. ### Is this just a CSP report collector? No. CentralCSP dedupes and classifies reports, keeps the raw JSON with source file, line and column, inventories scripts with integrity hashes, flags known CVEs, builds policy from production traffic, scores your posture, routes alerts, and exports audit evidence. ### Does it replace Sentry or a WAF? No. Those tools cover application errors, network and server telemetry. CentralCSP covers the scripts, requests and policy violations that execute in your users' browsers, then feeds that signal back into the stack you already run. ### Can I use the data in my own automation? Yes. Everything in the dashboard is available over the REST API, webhooks, and CSV, timeline and raw-report exports. AI agents can drive the platform over the built-in MCP server. ### Where is the data hosted? In France, on OVH. It never leaves the EU. ## Add the header. See what the browser sees. Start with one site and real production traffic. 14-day free trial, no agent to deploy. [Start free trial](https://app.next.centralcsp.com) [Scan your site](https://next.centralcsp.com/en/tools/csp-scanner/) --- Available in: [en](https://next.centralcsp.com/en/solutions/developers/), [fr](https://next.centralcsp.com/fr/solutions/developers/)