Skip to content
HeaderHawk

List the CSP policies a site's reports quoted

GET
/v1/sites/{siteId}/csp-policies
curl --request GET \
  --url 'https://api.us.headerhawk.com/v1/sites/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/csp-policies?limit=50' \
  --header 'Authorization: Bearer <token>'

Every Content-Security-Policy your pages served that a violation report in the window quoted, newest last seen first, with when a report first and last quoted each. Nonces are collapsed, and policies that differ only in directive order, case or repeats are one. pageId narrows it to one monitored page. Reads reported data, so it spends the tenant’s budget too.

Window: at most 31 days, the last 31 by default; longer is 400. Grouping reads every CSP report in the window. Measured worst case: 24 ms reading 65,239 reports (11 MB) of one site.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
siteId
required
string format: uuid

The site’s id.

Query Parameters

Section titled “Query Parameters”
pageId
string format: uuid

Only the policies quoted by reports from this monitored page.

from
string format: date-time

Only reports received at or after this instant. Defaults to the start of your retention window, or where the operation bounds its window, to that many days before to. Earlier than your retention reaches is 400.

to
string format: date-time

Only reports received before this instant. Defaults to now.

limit
integer
default: 50 >= 1 <= 200

How many items a page holds.

cursor
string
>= 1 characters <= 1024 characters

The previous page’s nextCursor. Omit it for the first page.

Responses

Section titled “Responses”

200

Section titled “200”

A page of policies

Media typeapplication/json
object
data
required
Array<object>
object
id
required

A hash of the disposition and the comparable policy: the id a csp.policy_changed alert names the policy by.

string
disposition
required

enforce or report. An open enum.

string
Allowed values: enforce report
policy
required

The comparable form, cut to 16 KB.

string
truncated
required
boolean
firstSeen
required

When a report in the window first quoted it: not when it was first served, if that was before from.

string format: date-time
lastSeen
required

When a report in the window last quoted it.

string format: date-time
reportCount
required

Reports that quoted it in the window.

integer
truncated
required

The site’s reports quoted more distinct policies in the window than one read returns (200, before merging), so only the most recently seen are listed. Narrow the window, or pageId, to see the rest.

boolean
nextCursor
required
string
nullable
Example
{
  "data": [
    {
      "disposition": "enforce"
    }
  ]
}

Headers

Section titled “Headers”
RateLimit-Limit
integer

The budget nearest to running out, per minute.

RateLimit-Remaining
integer

What is left of that budget this minute.

RateLimit-Reset
integer

Seconds until that budget starts again.

400

Section titled “400”

A parameter was refused, or one the operation does not take was sent. The message names it.

Media typeapplication/json
object
error
required
object
code
required

What went wrong. An open enum: treat a code you do not know by its HTTP status.

string
Allowed values: bad_request validation_error invalid_api_key plan_upgrade_required forbidden not_found rate_limited rate_limit_unavailable upstream_unavailable internal_error
message
required

For people. Branch on code.

string
requestId
required

Quote it when you write to us about this request.

string
Example
{
  "error": {
    "code": "bad_request"
  }
}

401

Section titled “401”

invalid_api_key: no key, or one that is malformed, unknown, revoked or expired. One answer for all of them.

Media typeapplication/json
object
error
required
object
code
required

What went wrong. An open enum: treat a code you do not know by its HTTP status.

string
Allowed values: bad_request validation_error invalid_api_key plan_upgrade_required forbidden not_found rate_limited rate_limit_unavailable upstream_unavailable internal_error
message
required

For people. Branch on code.

string
requestId
required

Quote it when you write to us about this request.

string
Example
{
  "error": {
    "code": "bad_request"
  }
}

403

Section titled “403”

plan_upgrade_required: the tenant’s plan does not include API access (the key works again when it does), or does not include what this operation reads.

Media typeapplication/json
object
error
required
object
code
required

What went wrong. An open enum: treat a code you do not know by its HTTP status.

string
Allowed values: bad_request validation_error invalid_api_key plan_upgrade_required forbidden not_found rate_limited rate_limit_unavailable upstream_unavailable internal_error
message
required

For people. Branch on code.

string
requestId
required

Quote it when you write to us about this request.

string
Example
{
  "error": {
    "code": "bad_request"
  }
}

404

Section titled “404”

No such resource in your tenant.

Media typeapplication/json
object
error
required
object
code
required

What went wrong. An open enum: treat a code you do not know by its HTTP status.

string
Allowed values: bad_request validation_error invalid_api_key plan_upgrade_required forbidden not_found rate_limited rate_limit_unavailable upstream_unavailable internal_error
message
required

For people. Branch on code.

string
requestId
required

Quote it when you write to us about this request.

string
Example
{
  "error": {
    "code": "bad_request"
  }
}

429

Section titled “429”

rate_limited: over a budget. Wait Retry-After seconds.

Media typeapplication/json
object
error
required
object
code
required

What went wrong. An open enum: treat a code you do not know by its HTTP status.

string
Allowed values: bad_request validation_error invalid_api_key plan_upgrade_required forbidden not_found rate_limited rate_limit_unavailable upstream_unavailable internal_error
message
required

For people. Branch on code.

string
requestId
required

Quote it when you write to us about this request.

string
Example
{
  "error": {
    "code": "bad_request"
  }
}

Headers

Section titled “Headers”
Retry-After
integer

Seconds to wait before trying again.

503

Section titled “503”

rate_limit_unavailable or upstream_unavailable: HeaderHawk could not serve this now. Nothing is wrong with the request; try again after Retry-After seconds.

Media typeapplication/json
object
error
required
object
code
required

What went wrong. An open enum: treat a code you do not know by its HTTP status.

string
Allowed values: bad_request validation_error invalid_api_key plan_upgrade_required forbidden not_found rate_limited rate_limit_unavailable upstream_unavailable internal_error
message
required

For people. Branch on code.

string
requestId
required

Quote it when you write to us about this request.

string
Example
{
  "error": {
    "code": "bad_request"
  }
}

Headers

Section titled “Headers”
Retry-After
integer

Seconds to wait before trying again.