How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Content-Security-Policy

Security Policy IANA permanent response reached by regulation

Constrains what the client may execute. Four providers declare it, because almost nobody documents edge headers in a contract.

CSP tells a browser which sources of script, style and content it may act on, and it is the most effective single control against cross-site scripting that exists. On a developer portal, a docs site, or any HTML surface an API provider operates, it belongs.

Four providers declare it in a published contract. That number measures documentation practice, not deployment: CSP is set at the edge and virtually nobody writes edge headers into an OpenAPI. It is the cleanest illustration of why the two measurements have to stay apart — scoring this from contracts would report a market failure that is really a convention gap.

The registry

Listed in the IANA HTTP Field Name Registry as a permanent entry. Defined in Content Security Policy Level 3.

In the catalog

Declared by 4 providers across 675 published specification files in the API Evangelist catalog, where it appears as a response header — sent by the server.

Reached by regulation

No law names this header. It is evidentiary — the deployed control for an obligation that regulation does impose. It is observable at the edge: an unauthenticated request is enough to see whether a provider sends it.

Using it

Start in Content-Security-Policy-Report-Only with a reporting endpoint, watch what breaks, then enforce. Avoid unsafe-inline; if you cannot, nonce your inline scripts. Interactive API consoles are the usual obstacle — they tend to want eval — and that is a reason to isolate the console on its own origin rather than to weaken the policy everywhere.

Reached by these regulations

Catalogued at regulations.apievangelist.com, with the basis of each connection recorded rather than implied.

Governed by these rules

Machine-enforceable governance rules from rules.apievangelist.com that apply to this header when it appears in an OpenAPI.

OpenAPI Components Headers Error error

Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses

Guidance: Rate Limits →
OpenAPI Components Headers Info info

Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses

Guidance: Rate Limits →
OpenAPI Headers Hyphenated Pascal Case error

HTTP headers should follow Hyphenated-Pascal-Case naming convention for consistency and readability, such as Content-Type, X-Request-Id, or Accept-Language.

Guidance: Naming →