--- schema_version: "1" id: 9aee4383ec99dc673b10e5e5a941ec756b79c112e715c113ed6419da7357ee74 title: BrowserPolicyViolation collection: legacydeveloper version: current locale: en-us portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/object_reference/sforce_api_objects_browserpolicyviolation.md canonical_url: https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_browserpolicyviolation.htm source_site: developer.salesforce.com content_type: documentation content_hash: 12ac88846cc639cac2c92c9b474fd8e5bbcdf738aaa3beb66ca6e0db6a5d45ea description: Represents a violation that occurred within the last seven days related to the Trusted URLs and Trusted URLs for External Redirects allowlists. These violations include blocked resource requests based on your content security policy (CSP) and blocked redirections. This object is available in API version 61.0 and later. --- # BrowserPolicyViolation Represents a violation that occurred within the last seven days related to the Trusted URLs and Trusted URLs for External Redirects allowlists. These violations include blocked resource requests based on your content security policy (CSP) and blocked redirections. This object is available in API version 61.0 and later. We recommend that you manage this object through the Trusted URL and Browser Policy Violations list in Setup. See [Manage Trusted URL and Browser Policy Violations](https://help.salesforce.com/s/articleView?id=xcloud.security_trusted_urls_csp_violations.htm&type=5&language=en_US) in Salesforce Help. ![Note](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/images/icon_note.png) #### Note To help preserve performance, Salesforce uses throttling, a technique that limits the number of generated violations when the volume is exceptionally high. Therefore, if your org generates a high volume of violations over a short period of time, some of those violations can fail to generate a BrowserPolicyViolation. To see detailed information about the captured CSP violations for your org, use the [CSP Violation Event Type](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_cspviolation.htm "CSP violation events capture details about blocked resource requests from Lightning Experience pages based on your content security policy (CSP). The CSP Violation event type is available in the EventLogFile object in API version 63.0 and later."). To understand when Salesforce captures blocked redirections, see [External Redirection Restrictions in Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.security_trusted_urls_external_redirections_understand.htm&language=en_US) in Salesforce Help. For detailed information about each blocked redirection, use the [Blocked Redirect Event Type](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_blockedredirect.htm "Blocked redirect events capture information about blocked redirections from Salesforce to untrusted and malformed URLs. The Blocked Redirect event type is available in the EventLogFile object in API version 63.0 and later."). When you delete a BrowserPolicyViolation, only the logged event is removed. If your allowlists still block those requests, a new BrowserPolicyViolation is generated the next time a matching request occurs. To help you manage the list, a daily process deletes violations that haven’t occurred within the last seven days. To track browser policy violations over time, schedule daily queries of the Blocked Redirect and CSP Violations event types. ## Supported Calls delete(), describeSObjects(), query(), retrieve() ## Special Access Rules Only users with the Customize Application and Modify All Data permissions can access this object. ## Fields | Field | Details | | --- | --- | | DeveloperName | Type string Properties Create, Filter, Group, Sort Description The developer name of the violation. Only users with View DeveloperName or View Setup and Configuration permission can view, group, sort, and filter this field. | | Language | Type picklist Properties Create, Defaulted on create, Filter, Group, Restricted picklist, Sort Description The language for the blocked request. | | MasterLabel | Type string Properties Create, Filter, Group, Sort Description Master label for this violation. | | NamespacePrefix | Type string Properties Filter, Group, Nillable, Sort Description Namespace prefix for this violation. | | UntrustedUrl | Type string Properties Create, Filter, Group, Nillable, Sort Description The URL associated with the blocked request, without the path. For example, if a blocked requested resource is an image with the URL https://www.example.com/images/image1.png, the UntrustedUrl is https://www.example.com. | | ViolationContext | Type picklist Properties Create, Filter, Group, Nillable, Restricted picklist, Sort Description If the ViolationType is img-src (image), font-src (fonts), or frame-src (iframe content), the content security policy (CSP) context for the request. The CSP context controls which pages can load content from a CspTrustedSite. Possible values are: - Lightning—The blocked request is related to a Lightning Experience page. - Not Applicable—ViolationContext isn’t applicable to this violation. For example, violations with a ViolationType of Redirection. | | ViolationImpact | Type String Properties Create, Filter, Group, Nillable, Restricted picklist, Sort Description The impact of this violation. Possible values are: - Blocked–The policy was enforced and prevented the resource from loading. The impact of blocked redirections and malformed URLs is always Blocked. - Reported–This violation is blocked only after stricter CSP settings are configured. For example, some resource requests associated with the frame-src, font-src, and img-src ViolationType are blocked only when the Adopt updated CSP directives setting is enabled in Session Settings. | | ViolationType | Type picklist Properties Create, Filter, Group, Nillable, Restricted picklist, Sort Description The violation type. Possible values are: - img-src–At least one request to load an image file from the URL was blocked because the UntrustedUrl isn’t a [CspTrustedSite](https://developer.salesforce.com/docs/atlas.en-us.264.0.object_reference.meta/object_reference/sforce_api_objects_csptrustedsite.htm) object with this CSP directive. - font-src–At least one request to load a font from the URL was blocked because the UntrustedUrl isn’t a [CspTrustedSite](https://developer.salesforce.com/docs/atlas.en-us.264.0.object_reference.meta/object_reference/sforce_api_objects_csptrustedsite.htm) object with this CSP directive. - frame-src–At least one request to load content in an iframe that originated from the URL was blocked because the UntrustedUrl isn’t a [CspTrustedSite](https://developer.salesforce.com/docs/atlas.en-us.264.0.object_reference.meta/object_reference/sforce_api_objects_csptrustedsite.htm) object with this CSP directive. - MalformedUrl–At least one redirection to this URL failed because the UntrustedUrl is malformed. - Redirect–At least one redirection to this URL was blocked because the UntrustedUrl isn’t a [RedirectWhitelistUrl](https://developer.salesforce.com/docs/atlas.en-us.264.0.object_reference.meta/object_reference/sforce_api_objects_redirectwhitelisturl.htm) object. |