--- schema_version: "1" id: 206c0761bbf8d63edf178314a15e5cfd333aab430e9f850e0291dd1536b03772 title: CspTrustedSite collection: legacydeveloper version: current locale: en-us portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/object_reference/sforce_api_objects_csptrustedsite.md canonical_url: https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_csptrustedsite.htm source_site: developer.salesforce.com content_type: documentation content_hash: 2e0e3653edf1e4959233fbcd32376366432f406b6c2fbb7f0a9e332b11156eef description: Represents a trusted URL. For each CspTrustedSite, you can specify Content Security Policy (CSP) directives and permissions policy directives. Each CSP directive allows Lightning components, third-party APIs, and WebSocket connections to access a resource type from the trusted URL. If the Permissions-Policy HTTP header is enabled, each permissions policy directive grants the trusted URL access to a browser feature. In API version 58.0 and earlier, CspTrustedSite included only CSP directives and was referred to as CSP Trusted Sites in Salesforce Setup. Available in API version 39.0 and later. --- # CspTrustedSite Represents a trusted URL. For each CspTrustedSite, you can specify Content Security Policy (CSP) directives and permissions policy directives. Each CSP directive allows Lightning components, third-party APIs, and WebSocket connections to access a resource type from the trusted URL. If the Permissions-Policy HTTP header is enabled, each permissions policy directive grants the trusted URL access to a browser feature. In API version 58.0 and earlier, CspTrustedSite included only CSP directives and was referred to as CSP Trusted Sites in Salesforce Setup. Available in API version 39.0 and later. ## Supported Calls create(), delete(), describeSObjects(), query(), retrieve(), update(), upsert() ## Fields | Field | Details | | --- | --- | | CanAccessCamera | Type boolean Properties Create, Defaulted on create, Filter, Group, Sort, Update Description Indicates whether this CspTrustedSite can access the user’s camera. The default value is false. This field takes effect only when the enablePermissionsPolicy field equals true and the grantCameraAccess field equals TrustedUrls in the SecuritySettings metadata API type. This field is available in API version 59.0 and later. | | CanAccessMicrophone | Type boolean Properties Create, Defaulted on create, Filter, Group, Sort, Update Description Indicates whether this CspTrustedSite can access the user’s microphone. The default value is false. This field takes effect only when the enablePermissionsPolicy field equals true and the grantMicrophoneAccess field is TrustedUrls in the SecuritySettings metadata API type. This field is available in API version 59.0 and later. | | Context | Type picklist Properties Create, Filter, Group, Restricted picklist, Sort, Update Description Declares the scope of the CSP directives for this trusted URL. Possible values are: - All—Apply the CSP directives to all supported context types. - Communities—Apply the CSP directives to Experience Builder sites only. - FieldServiceMobileExtension—Apply the CSP directives to the Field Service Mobile Extensions only. - LEX—Apply the CSP directives to Lightning Experience only. - LightningOut—Reserved for future use. Available in API version 64.0 and later - VisualForce—Apply the CSP directives to custom Visualforce pages only. This value is available in API version 55.0 and later. For custom Visualforce pages, content is restricted to trusted URLs only if the page’s cspHeader attribute is set to true. This field is available in API version 44.0 and later. | | Description | Type textarea Properties Create, Filter, Group, Nillable, Sort, Update Description The description of the trusted URL. Limit: 255 characters. | | DeveloperName | Type string Properties Create, Filter, Group, Sort, Update Description The developer name of the trusted URL. Only users with View DeveloperName OR View Setup and Configuration permission can view, group, sort, and filter this field. | | EndpointUrl | Type string Properties Create, Filter, Group, Sort, Update Description The URL for this CspTrustedSite. - This field must include a domain name and can include a port. For example, https://example.com or https://example.com:8080. To reduce repetition, you can use the wildcard character \* (asterisk). For example, \*.example.com. Don't include placeholders or invalid characters. For example, don't use malformed^url.example.com, and https://{subdomain}.example.com. - For a third-party API, the URL must begin with https://. For example, https://example.com. - For a WebSocket connection, the URL must begin with wss://. For example, wss://example.com. - For a Chrome extension, use the 32-character extension ID in the format chrome-extension://abcdefghijklmnopabcdefghijklmnop. The ID can contain only lowercase letters a–p. Wildcards aren’t supported in Chrome extension URIs. Before February 2025, it was possible to save a malformed URL. Malformed URLs are excluded from generated CSP HTTP headers. To keep your Trusted URLs list accurate, remove any malformed entries. You can use an Apex class to find all malformed URLs. See the knowledge article, [Identify Malformed Trusted URLs](https://help.salesforce.com/s/articleView?id=005317938&type=1&language=en_US). To add a URL based on parameters, build the URL before you update the EndpointUrl field. | | IsActive | Type boolean Properties Create, Defaulted on create, Filter, Group, Sort, Update Description Indicates whether this CspTrustedSite is active. | | IsApplicableToConnectSrc | Type boolean Properties Create, Defaulted on create, Filter, Group, Sort, Update Description Indicates whether Lightning components, third-party APIs, and WebSocket connections can load URLs using script interfaces from this trusted URL. | | IsApplicableToFontSrc | Type boolean Properties Create, Defaulted on create, Filter, Group, Sort, Update Description Indicates whether Lightning components, third-party APIs, and WebSocket connections can load fonts from this trusted URL. | | IsApplicableToFrameSrc | Type boolean Properties Create, Defaulted on create, Filter, Group, Sort, Update Description Indicates whether Lightning components, third-party APIs, and WebSocket connections can load resources contained in