Constrains what the client may execute. Four providers declare it, because almost nobody documents edge headers in a contract.
Content-Security-Policy
Security Policy IANA permanent response reached by regulation
CSP tells a browser which sources of script, style and content it may act on, and it is the most effective single control against cross-site scripting that exists. On a developer portal, a docs site, or any HTML surface an API provider operates, it belongs.
Four providers declare it in a published contract. That number measures documentation practice, not deployment: CSP is set at the edge and virtually nobody writes edge headers into an OpenAPI. It is the cleanest illustration of why the two measurements have to stay apart — scoring this from contracts would report a market failure that is really a convention gap.
The registry
Listed in the IANA HTTP Field Name Registry as a permanent entry. Defined in Content Security Policy Level 3.
In the catalog
Declared by 4 providers across 675 published specification files in the API Evangelist catalog, where it appears as a response header — sent by the server.
Reached by regulation
No law names this header. It is evidentiary — the deployed control for an obligation that regulation does impose. It is observable at the edge: an unauthenticated request is enough to see whether a provider sends it.
Using it
Start in Content-Security-Policy-Report-Only with a reporting endpoint, watch what breaks, then enforce. Avoid unsafe-inline; if you cannot, nonce your inline scripts. Interactive API consoles are the usual obstacle — they tend to want eval — and that is a reason to isolate the console on its own origin rather than to weaken the policy everywhere.
Reached by these regulations
Catalogued at regulations.apievangelist.com, with the basis of each connection recorded rather than implied.
Governed by these rules
Machine-enforceable governance rules from rules.apievangelist.com that apply to this header when it appears in an OpenAPI.
OpenAPI Components Headers Error error
Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses
Guidance: Rate Limits →OpenAPI Components Headers Info info
Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses
Guidance: Rate Limits →OpenAPI Headers Hyphenated Pascal Case error
HTTP headers should follow Hyphenated-Pascal-Case naming convention for consistency and readability, such as Content-Type, X-Request-Id, or Accept-Language.
Guidance: Naming →