Content Security Policy reports browsers sent

Content Security Policy violations on the organization's sites.

A site whose policy names fastmon in report-to or report-uri gets a report from the browser for every script, style or request the policy blocked, or would have blocked under Content-Security-Policy-Report-Only. The answer counts them over the window, per bucket, per directive and per disposition.

Beside each count stands affected_visitors, the distinct visitors behind it. A visitor is a non-zero stitch, so only sites with store_stitch count them, and meta.stitchless_site_ids names the sites that do not.

The counts are the reports the browsers sent. The edge does not sample them, so meta.sampling does not describe them. disposition tells blocked violations (enforce) from merely reported ones (report), and '' counts the reports whose browser did not say.

Filters: the site scope, stitch, the report's own report_id, disposition, effective_directive, blocked_url, source_url, page_url and status_code_range, and the edge-derived dimensions (country, asn, device_type, browser, browser_version, os, bot_class, is_bot, is_datacenter, bot_name, bot_type, datacenter, ua_anomaly). exclude takes disposition, effective_directive, blocked_url, source_url, page_url and the nine edge labels. Any other filter is a 422 naming it, since an empty answer would read as "no violations".