---
title: "Parse a Content-Security-Policy, explain each directive and flag weaknesses (unsafe-inline, wildcards, missing object-src/base-uri/frame-ancestors…)."
method: POST
path: "/api/v1/csp"
tags: ["Web Tools"]
---

# Parse a Content-Security-Policy, explain each directive and flag weaknesses (unsafe-inline, wildcards, missing object-src/base-uri/frame-ancestors…).

`POST /api/v1/csp`

## Request

- Base URL: `https://programmes.net`
- URL: `https://programmes.net/api/v1/csp`
- Auth: none declared

CSP Evaluator. Operations: `evaluate` — Parse a CSP header and return its directives and findings by severity. `harden` — Add the low-risk directives a policy is missing (object-src 'none', base-uri, frame-ancestors, form-action) and return ready-to-paste header, meta, nginx and Apache forms.

## Request body

- union
  - CspEvaluate: Parse a CSP header and return its directives and findings by severity.
    - `operation` 'evaluate', required
    - `input` string: A CSP header value (optionally with the "Content-Security-Policy:" name).
    - `options` object
  - CspHarden: Add the low-risk directives a policy is missing (object-src 'none', base-uri, frame-ancestors, form-action) and return ready-to-paste header, meta, nginx and Apache forms.
    - `operation` 'harden', required
    - `input` string: A CSP header value.
    - `options` object

## Response `200`

The operation ran.

- object
  - `ok` unknown, required
  - `tool` 'csp', required
  - `operation` 'evaluate' | 'harden', required
  - `result` unknown, required

## Other responses

- `400`: The request is not valid (https://programmes.net/api#invalid-request); The tool has no such operation (https://programmes.net/api#unknown-operation)
- `404`: No such tool (https://programmes.net/api#unknown-tool)
- `413`: The request or its input is too large (https://programmes.net/api#content-too-large)
- `415`: The body must be JSON (https://programmes.net/api#unsupported-media-type)
- `422`: An option is missing, of the wrong type or out of range (https://programmes.net/api#invalid-options); This call needs more CPU than one API call may use (https://programmes.net/api#refused); The operation could not process the input (https://programmes.net/api#tool-error)
- `429`: Too many requests (https://programmes.net/api#rate-limited)
- `500`: Internal error (https://programmes.net/api#internal-error)

---

[API](https://skmtc.dev/programmes/apis/programmes-net-api.md) · [All operations](https://skmtc.dev/programmes/apis/programmes-net-api/llms.txt) · [OpenAPI document](https://skmtc.dev/programmes/apis/programmes-net-api/revisions/aa939784a2e6?raw)