BAbase44

Update security headers

Changed on

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Changes the app's security header settings and returns them as they now stand.

Send only the settings you want to change. A setting you leave out keeps its value.

A change applies to the published app right away, with no need to deploy it again. It doesn't affect the app editor's preview.

Turning on a setting that Get security scan recommends in header_recommendations removes that recommendation from the scan result.

put/api/apps/{app_id}/security/headers

Request

  • Base URL
    https://app.base44.com
  • URL
    https://app.base44.com/api/apps/{app_id}/security/headers
  • Auth
    HTTP bearer

Path parameters

app_idstring required

ID of the app.

Request body

prevent_iframe_embeddingboolean nullable

Set true to stop every site from showing the published app in a frame. Set false to lift that block, so framing follows the app's other settings and its workspace's policy again.

restrict_browser_featuresboolean nullable

Set true to make the published app send a restrictive Permissions-Policy header, or false to stop sending it.

Example request

{
  "prevent_iframe_embedding": true
}

Response

The app's security header settings after the change.

Example response

{
  "result": {
    "embedding_origins": [
      "https://partners.acme.com"
    ],
    "org_embedding_origins": [
      "https://partners.acme.com"
    ],
    "app_policy": {
      "mode": "allowlist",
      "origins": [
        "https://partners.acme.com"
      ]
    },
    "effective_policy": {
      "mode": "allowlist",
      "source": "app",
      "origins": [
        "https://partners.acme.com"
      ]
    }
  }
}

Changes