Analyze a policy value

Reviews a Content-Security-Policy header value on its own and reports what each directive does and where the policy is weak, for example an unsafe keyword or an overly broad source. Nothing is fetched and nothing is saved, so use it for a policy you are drafting. To grade the policy a site actually serves, run a scan instead.

Requires membership of the workspace.

Authorization

AuthorizationBearer <token>

An OpenID Connect access token issued by Keycloak, acting as the signed-in user.

In: header

Path Parameters

workspaceId*string

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

csp*string

The Content-Security-Policy header value to review.

Length1 <= length <= 65536

language?string

Language the findings are written in. en is English and fr is French.

Default"en"

Value in

"en"
"fr"

Response Body

`application/json`

curl -X POST "https://example.com/v1/workspaces/string/csp/analyze" \  -H "Content-Type: application/json" \  -d '{    "csp": "default-src \'self\'; script-src \'self\' \'report-sample\' https://js.stripe.com"  }'

{}