< Reporting-Endpoints: csp-endpoint="https://example.com/csp-reports"

TL;DR: Reporting-Endpoints declares named URLs for the browser Reporting API: Reporting-Endpoints: csp-endpoint="https://example.com/csp-reports". CSP’s report-to csp-endpoint, COOP, deprecation and crash reports then deliver there. It replaces the deprecated Report-To header for declaring endpoints.

Syntax

Reporting-Endpoints: csp-endpoint="https://example.com/csp-reports"
Reporting-Endpoints: csp-endpoint="https://example.com/csp-reports", coop-endpoint="https://example.com/coop-reports"

Each entry is name="url". URLs must be quoted and HTTPS; non-secure endpoints are ignored. The names are arbitrary tokens that other headers reference.

The name default is special. It receives reports from features with no endpoint name of their own, such as Permissions-Policy violations, and reports with no associated header at all, such as deprecation reports:

Reporting-Endpoints: default="https://example.com/reports"

Who uses it

CSP, through the report-to directive:

Reporting-Endpoints: csp-endpoint="https://example.com/csp-reports"
Content-Security-Policy: default-src 'self'; report-to csp-endpoint

Also Cross-Origin-Opener-Policy reports (see COOP), Integrity-Policy violations, deprecation reports, and crash and intervention reports. For CSP rollout with this header, read CSP Report-Only.

What the browser sends

A POST with Content-Type: application/reports+json and a JSON array of reports:

[
  {
    "type": "deprecation",
    "age": 10,
    "url": "https://example.com/",
    "user_agent": "Mozilla/5.0 ...",
    "body": { "id": "ExampleFeature", "message": "..." }
  }
]

Reports are queued and delivered asynchronously, often batched, so expect a delay rather than an immediate request.

Moving off Report-To

Report-To carries a JSON value with a group, a max_age and a list of endpoints:

Report-To: { "group": "csp-endpoints", "max_age": 10886400, "endpoints": [{ "url": "https://example.com/reports" }] }

Migration: add Reporting-Endpoints with the same URL under a name and point report-to at that name. While you support browsers you have not tested, send both headers. There is no max_age in the new header, so send it on every HTML response rather than once.

NEL still names a group

Network Error Logging has its own header whose report_to field names a reporting group:

NEL: { "report_to": "network-errors", "max_age": 2592000 }
Report-To: { "group": "network-errors", "max_age": 2592000, "endpoints": [{ "url": "https://example.com/nel" }] }

That pairing is how NEL is documented, so a site using NEL keeps its Report-To header for it even after moving CSP and COOP to Reporting-Endpoints.

Gotchas

• Send the header on the response for the document or worker whose reports you want. Putting it only on API responses does nothing for the page.
• Reports are POSTed by browsers on behalf of arbitrary visitors. Treat the bodies as untrusted data, and rate-limit the collector.
• A mistyped name in report-to fails silently. Compare it with the header key character by character.

Verify

curl -sI https://example.com | grep -i -E 'reporting-endpoints|report-to|content-security-policy'

Then trigger a violation in DevTools. Chromium’s Application panel has a Reporting API section listing queued reports and their delivery status.

Related

• Content-Security-Policy, CSP Report-Only
• COOP, COEP