Build a recommended Permissions-Policy

Builds a Permissions-Policy for the website from the Permissions-Policy reports browsers sent over the period, and returns the header value in policy.

Without a policy, it starts with every common browser feature denied. With one, it keeps that policy. It then grants each feature your pages used to self, and each feature an embedded frame asked for through its allow attribute to that frame's origin. It leaves out a feature only a third-party script used, since granting it would hand the feature to that script too, and noise: a feature reported fewer than 10 times in the period.

Send reportingEndpoints as the Reporting-Endpoints header alongside it: Permissions-Policy reports go to its default group. Deploy it as Permissions-Policy-Report-Only first to see what it would block.

The period defaults to the last 7 days and covers up to 30.

Anyone who knows the reporting endpoint can send reports to it, so a feature in the result is not proof that your pages use it. Review the granted features before deploying, especially those granted to another origin.

Limited to 10 requests a minute for each person, after which it answers 429 with a Retry-After header.

Requires the viewer role on the website and the report:permissions-policy-violation plan feature.

curl -X POST "https://example.com/v1/workspaces/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/websites/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/permissions-policy/recommended-policy" \  -H "Content-Type: application/json" \  -d '{}'

{  "policy": "camera=(self), geolocation=(self), payment=(\"https://pay.example.com\"), usb=()",  "reportingEndpoints": "centralcsp=\"https://e0123456789abcdef0123.report.centralcsp.com\", default=\"https://e0123456789abcdef0123.report.centralcsp.com\""}