report-to

report-to names an endpoint declared separately by the Reporting-Endpoints response header. The indirection is the point: one endpoint declaration can serve CSP, deprecation reports, interventions and network errors.

Reports arrive in a different shape from report-uri’s - a batched JSON array of envelopes with camelCase field names, posted as application/reports+json. HeaderHawk accepts both formats on the same URL and normalizes them, so switching does not change what you see in the dashboard.

Syntax

Reporting-Endpoints: csp-endpoint="https://ingest.headerhawk.com/csp/YOUR_INGEST_CODE"
Content-Security-Policy: …; report-to csp-endpoint

What it controls

• Where violation reports for this policy are sent.

What it does not control

• What is allowed. Like report-uri, it never blocks and is never violated.

Fallback

report-to has no fallback. It names an endpoint group, and a policy without it - and without report-uri - sends reports nowhere.

Recommended value

Content-Security-Policy: report-to csp-endpoint

• Declare the endpoint once in Reporting-Endpoints and reference it by name. The name is arbitrary and local to your site.
• Keep report-uri in the same policy. Browsers that understand report-to ignore report-uri, and browsers that do not get the only endpoint they can use.
• Reports are batched and delivered out of band, so the first one can arrive seconds after the violation. When you are checking that setup works, give it a minute before concluding nothing is arriving.

Examples

Allowed

The report body a browser posts, as application/reports+json:

[
  {
    "age": 53531,
    "type": "csp-violation",
    "url": "https://example.com/checkout",
    "user_agent": "Mozilla/5.0 …",
    "body": {
      "blockedURL": "inline",
      "disposition": "enforce",
      "documentURL": "https://example.com/checkout",
      "effectiveDirective": "script-src-elem",
      "originalPolicy": "default-src 'self'; report-to csp-endpoint",
      "sample": "console.log(\"lo\")",
      "sourceFile": "https://example.com/checkout",
      "lineNumber": 121,
      "columnNumber": 39,
      "statusCode": 200
    }
  }
]

Browser support

• Baseline 2026: newly available. It works across the latest versions of every major browser as of March 2026, and not in older ones - which is precisely why report-uri stays in the policy.
• Not supported in <meta> elements.
• The older Report-To header also declares endpoint groups and is still accepted by some browsers, but Reporting-Endpoints is the current mechanism.

In a HeaderHawk report

• report-to is never violated. It configures reporting.
• HeaderHawk records which format each report arrived in as reportFormat - csp-report for report-uri, reporting-api for report-to. That field is how you confirm a report-to rollout is actually being used rather than silently falling through to report-uri.

Related directives

• report-uri

Getting reports for this directive

Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.