---
title: "Get security headers"
method: GET
path: "/api/apps/{app_id}/security/headers"
---

# Get security headers

`GET /api/apps/{app_id}/security/headers`

## Request

- Base URL: `https://app.base44.com`
- URL: `https://app.base44.com/api/apps/{app_id}/security/headers`
- Auth: HTTP bearer

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Returns the app's security header settings, and the framing policy the published app follows once its workspace's policy is applied.

Change `prevent_iframe_embedding` and `restrict_browser_features` with [Update security headers](/api-reference/update-security-headers). `effective_policy` is what the published app actually enforces, so read it rather than working the policy out from the other fields. When `app_allowlist_locked_by_workspace` is `true`, the workspace's policy decides who can frame the app.

This is limited to 60 requests per minute per app for each workspace's personal API keys, so every key in a workspace shares one allowance. Some workspaces have a different limit.

<Note>This endpoint accepts a personal API key belonging to a user with editor access to the app, including a read-only key. Workspace API keys are not accepted.</Note>

## Path parameters

- `app_id` string, required: ID of the app.

## Response `200`

The app's security header settings.

- SecurityHeadersSettingsResponse
  - `result` SecurityHeadersSettingsResult, required: Security header settings for one app.
    - `prevent_iframe_embedding` boolean, required: Whether the app blocks every site from showing it in a frame. The value is `true` when the app blocks them, and the published app then sends `X-Frame-Options: DENY`. The value is `false` when the app doesn't.
    - `restrict_browser_features` boolean, required: Whether the published app sends a restrictive `Permissions-Policy` header. The value is `true` when the app sends it and `false` when the app doesn't. The header lets only the app's own pages use the camera, microphone, location, payment, and USB features, and turns off the magnetometer and gyroscope.
    - `embedding_origins` string[], nullable, required: Sites the app itself allows to frame it, or `null` when the app has no list of its own.
    - `org_embedding_origins` string[], nullable, required: Sites the app's workspace allows to frame its apps, or `null` when the workspace sets no list or its plan doesn't include one.
    - `org_prevent_iframe_embedding` boolean, required: Whether the app's workspace blocks framing for all of its apps. The value is `true` when the workspace does and `false` when it doesn't.
    - `app_policy` AppEmbeddingPolicyResult, required: An app's own framing policy.
      - `mode` 'inherit' | 'block_all' | 'allowlist', required: What the app's own setting says. - `inherit`: The app sets no policy and follows its workspace. - `block_all`: No site can frame the app. - `allowlist`: Only the sites in `origins` can.
      - `origins` string[], nullable, required: Sites allowed to frame the app when `mode` is `allowlist`, or `null` for the other modes.
    - `effective_policy` EffectiveEmbeddingPolicyResult, required: A published app's framing policy after its workspace policy is applied.
      - `mode` 'anyone' | 'block_all' | 'allowlist', required: Who can show the published app in a frame. - `anyone`: Any site can. - `block_all`: No site can. - `allowlist`: Only the sites in `origins` can.
      - `source` 'default' | 'app' | 'workspace', required: Where the policy comes from. - `app`: The app's own setting. - `workspace`: The app's workspace policy. - `default`: Neither sets one.
      - `origins` string[], nullable, required: Sites allowed to frame the app when `mode` is `allowlist`, or `null` for the other modes.
    - `app_allowlist_locked_by_workspace` boolean, required: Whether the app's workspace controls which sites can frame its apps. The value is `true` when the workspace does, so the app can't set a list of its own, and `false` when it doesn't.

## Other responses

- `401`: Missing or invalid credentials.
- `403`: You don't have editor access to this app, or you used a workspace API key.
- `404`: App not found.
- `429`: Rate limit exceeded. The base limit is 60 requests per minute per app. Wait the number of seconds in the `Retry-After` header before you retry.

## Changes

- **2026-10-13** `06cfcce0bdd9`: 2 info
  - the security scope `read_only` was added to the endpoint's security scheme `PersonalAccessTokenAuth`
  - the security scope `full_access` was removed from the endpoint's security scheme `PersonalAccessTokenAuth`
- **2026-10-11** `80287813ab84`: 1 info
  - the endpoint scheme security `PersonalAccessTokenAuth` was added to the API
- **2026-10-10** `fc604cdcc3a2`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/idealspot/apis/base44-app-management-api/changes/api/apps/:app_id/security/headers/get.md)

---

[API](https://skmtc.dev/idealspot/apis/base44-app-management-api.md) - [All operations](https://skmtc.dev/idealspot/apis/base44-app-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/idealspot/apis/base44-app-management-api/revisions/b5b4ebd82a1e?raw)