---
title: "Receive a Content-Security-Policy violation report"
method: POST
path: "/api/csp-report"
---

# Receive a Content-Security-Policy violation report

`POST /api/csp-report`

## Request

- Base URL: `https://bernstein.run`
- URL: `https://bernstein.run/api/csp-report`
- Auth: none declared

Accepts both wire formats: a single kebab-case report under a `csp-report` key (`report-uri`, which is what Firefox and Safari send) and an array of Reporting API envelopes (`report-to`, which Chrome sends and batches). Envelopes whose `type` is not `csp-violation` are ignored. Unauthenticated by construction, since browsers send these without credentials; the body is treated as hostile, summarised into the server log, and never echoed back.

## Response `204`

Always, whatever happened. A report that was rate-limited, oversized, wrongly typed or unparseable gets the same empty reply as one that was logged: a browser cannot act on the status, and a uniform answer tells a prober nothing.

---

[API](https://skmtc.dev/bernstein/apis/bernstein-task-server.md) · [All operations](https://skmtc.dev/bernstein/apis/bernstein-task-server/llms.txt) · [OpenAPI document](https://skmtc.dev/bernstein/apis/bernstein-task-server/revisions/2a20a34ad2eb?raw)