---
schema_version: "1"
id: 95b226fd8070397c6a6f0881a9ef1cf9dc4ac8152b932ba5add632df5a3efedd
title: HTTP Security Headers API
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/marketing-cloud/guides/mc-apis/securityHeaders-overview.md
canonical_url: https://developer.salesforce.com/docs/marketing/marketing-cloud/references/mc_rest_security/securityHeaders-overview.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 6c0a5655c632bc8062f1416d542f4d3abc168948c3e7588d0ba7c50d0a259a5f
products:
  - Marketing Cloud Engagement APIs and Programmatic Languages
  - Marketing Cloud
---
# HTTP Security Headers API

Apply and manage HTTP security headers for SAP-branded `view` and `click` domains.

This API supports create, read, update, and delete (CRUD) operations. Image and CloudPage domains aren't supported.

## Available Headers

The HTTP Security Headers API supports a discrete set of header and value pairs. Developers select which headers to
apply from these nine options.

| Header                      | Value                                                   |
| --------------------------- | ------------------------------------------------------- |
| `Content-Security-Policy`   | default-src 'self'; frame-ancestors 'self'              |
| `X-Frame-Options`           | SAMEORIGIN                                              |
| `X-Content-Type-Options`    | nosniff                                                 |
| `Referrer-Policy`           | origin-when-cross-origin                                |
| `Strict-Transport-Security` | max-age=31536000; includeSubDomains                     |
| `Cache-Control`             | no-cache, must-revalidate, max-age=0, no-store, private |
| `X-XSS-Protection`          | 1; mode=block                                           |
| `Permissions-Policy`        | geolocation=(self), microphone=()                       |
| `Set-Cookie`                | strict                                                  |

**note:** The `Content-Security-Policy` sometimes breaks external content when applied to `view` domains. For example, it's possible to break an image that's hosted on another domain.
Test your pages to ensure that your content renders as intended.

## Base URI

In this base URI example, the abbreviation {tse} is a placeholder that occupies the place of the tenant-specific-endpoint for the account.

```http
https://{tse}.rest.marketingcloudapis.com/
```

## Supported Use Cases

| Function                                                      | Method | Route                                    | Permissions                      |
| ------------------------------------------------------------- | ------ | ---------------------------------------- | -------------------------------- |
| [Get All HTTP Security Headers](https://developer.salesforce.com/docs/marketing/marketing-cloud/references/mc_rest_security/securityHeaders-get-all.md) | GET    | /messaging/v1/securityHeaders/all        | Security > HTTP Headers > View   |
| [Get HTTP Security Headers](https://developer.salesforce.com/docs/marketing/marketing-cloud/references/mc_rest_security/securityHeaders-read.md)        | GET    | /messaging/v1/securityHeaders            | Security > HTTP Headers > View   |
| [Update HTTP Security Headers](https://developer.salesforce.com/docs/marketing/marketing-cloud/references/mc_rest_security/securityHeaders-update.md)   | POST   | /messaging/v1/securityHeaders            | Security > HTTP Headers > Update |
| [Delete HTTP Security Headers](https://developer.salesforce.com/docs/marketing/marketing-cloud/references/mc_rest_security/securityHeaders-delete.md)   | DELETE | /messaging/v1/securityHeaders/{PageType} | Security > HTTP Headers > Delete |

## Error Handling

This API uses the standard error status codes outlined on the [Handle Errors in REST API page](https://developer.salesforce.com/docs/marketing/marketing-cloud/references/mc-apis/error-handling.md).

## Related Items

- [Sender Authentication Package](https://help.salesforce.com/s/articleView?id=mktg.mc_es_sender_authentication_package.htm)
- [Set Up Your Development Environment for Enhanced Packages](https://developer.salesforce.com/docs/marketing/marketing-cloud/references/mc-getting-started/mc-dev-setup-enhanced.md)
- [HTTP Headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers)
- [Handle Errors in REST API page](https://developer.salesforce.com/docs/marketing/marketing-cloud/references/mc-apis/error-handling.md)