CentralCSP
APIReports

Export individual reports

Streams individual reports as CSV, newest first, with the same filters as the list endpoint and no pagination. One column per stored field, so the columns depend on the report type. The file holds at most 10,000 reports: narrow the range or the filters to export older ones.

Requires the viewer role on the website and the report type's plan feature.

GET
/v1/workspaces/{workspaceId}/websites/{websiteId}/reports/{type}/raw/export

Authorization

AuthorizationBearer <token>

An OpenID Connect access token issued by Keycloak, acting as the signed-in user.

In: header

Path Parameters

workspaceId*string

The workspace's id.

websiteId*string

The website's id.

type*string

Which kind of report to read. A website only collects the types its plan includes and its ingestion settings allow.

Value in

  • "csp-violation"
  • "csp-hash"
  • "integrity-violation"
  • "permissions-policy-violation"
  • "potential-permissions-policy-violation"
  • "document-policy-violation"
  • "connection-allowlist"
  • "intervention"
  • "deprecation"
  • "crash"
  • "coop"
  • "coep"
  • "network-error"

Query Parameters

range*string

How far back to look, counted from now. Reports are kept for 90 days, so 90d is the widest range available.

Default"7d"

Value in

  • "24h"
  • "7d"
  • "30d"
  • "90d"
search?string

Match part of the page URL a report came from.

Lengthlength <= 1024
browser?string

Only reports from this browser.

Lengthlength <= 255
directive?string

Only reports for this CSP directive.

Lengthlength <= 255
disposition?string

Only enforce or only report reports.

Lengthlength <= 255
destination?string

Only reports for this request destination, such as script.

Lengthlength <= 255
hashAlgorithm?string

Only reports using this hash algorithm.

Lengthlength <= 255
policy?string

Only reports naming this policy.

Lengthlength <= 255
visibility?string

Only reports from pages in this visibility state, such as visible.

Lengthlength <= 255
kind?string

Only reports of this kind, such as tcp.refused.

Lengthlength <= 255
phase?string

Only reports raised in this phase, such as dns, connection or application.

Lengthlength <= 255

Response Body

text/csv

curl -X GET "https://example.com/v1/workspaces/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/websites/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/reports/csp-violation/raw/export?range=24h"
"string"