--- schema_version: "1" id: c0a45aea34083fdf4dfedfbe6cd194c6e8931a09dc95826b7f5997913c245e0a title: CSP Violation Event Type collection: legacydeveloper version: current locale: en-us portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/object_reference/sforce_api_objects_eventlogfile_cspviolation.md canonical_url: https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_cspviolation.htm source_site: developer.salesforce.com content_type: documentation content_hash: 8e7700c12a46ef44533a50a0d26664379592e824cbaa146feaafc7b6bba47445 description: CSP violation events capture details about blocked resource requests from Lightning Experience pages based on your content security policy (CSP). The CSP Violation event type is available in the EventLogFile object in API version 63.0 and later. --- # CSP Violation Event Type CSP violation events capture details about blocked resource requests from Lightning Experience pages based on your content security policy (CSP). The CSP Violation event type is available in the EventLogFile object in API version 63.0 and later. This event is free for all customers with a 24-hour data retention period. The CSP violation event is available in the API but not in the Event Monitoring Analytics app. For details about event monitoring, see the [Trailhead Event Monitoring module](https://trailhead.salesforce.com/en/modules/event_monitoring/units/event_monitoring_intro "HTML (New Window)") or the [REST API Developer’s Guide](https://developer.salesforce.com/docs/atlas.en-us.264.0.api_rest.meta/api_rest/using_resources_event_log_files.htm "HTML (New Window)"). ![Note](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/images/icon_note.png) #### Note To help preserve performance, Salesforce uses throttling, a technique that limits the number of generated CSP violation events when the volume is exceptionally high. Therefore, if your org generates a high volume of CSP violations over a short period of time, some of those violations can fail to generate a CSP violation event. ## Fields | Field | Details | | --- | --- | | BLOCKED\_URI | Type String Description The full string of the blocked resource. If the call to the blocked resource used a URL, BLOCKED\_URI is the full URL. Or, for violations with a DIRECTIVE of script-src directives, inline or eval. Examples - https://www.example.com/images/picture.png - file://host1:0002/media/video.mp4 - inline | | BLOCKED\_URI\_DOMAIN | Type String Description If BLOCKED\_URI is a URL, the domain for that URL. To allow resources to be loaded from the BLOCKED\_URI, BLOCKED\_URI\_DOMAIN is the endpointUrl value to add or update in the [CspTrustedSite](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_csptrustedsite.htm "Represents a trusted URL. For each CspTrustedSite, you can specify Content Security Policy (CSP) directives and permissions policy directives. Each CSP directive allows Lightning components, third-party APIs, and WebSocket connections to access a resource type from the trusted URL. If the Permissions-Policy HTTP header is enabled, each permissions policy directive grants the trusted URL access to a browser feature. In API version 58.0 and earlier, CspTrustedSite included only CSP directives and was referred to as CSP Trusted Sites in Salesforce Setup. Available in API version 39.0 and later.") Metadata API. Example www.example.com | | COLUMN\_NUMBER | Type Number Description The column number in the document or worker script at which the violation occurred. This value is relevant only when DIRECTIVE is script-src. For those violations, use this value with LINE\_NUMBER to identify the location of the violation. Example 27 | | CONTEXT | Type String Description The content security policy (CSP) context for the request. The CSP context controls which pages can load content from a [CspTrustedSite](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_csptrustedsite.htm "Represents a trusted URL. For each CspTrustedSite, you can specify Content Security Policy (CSP) directives and permissions policy directives. Each CSP directive allows Lightning components, third-party APIs, and WebSocket connections to access a resource type from the trusted URL. If the Permissions-Policy HTTP header is enabled, each permissions policy directive grants the trusted URL access to a browser feature. In API version 58.0 and earlier, CspTrustedSite included only CSP directives and was referred to as CSP Trusted Sites in Salesforce Setup. Available in API version 39.0 and later."). CSP violation events capture details about blocked resource requests from only Lightning Experience pages, this value is always Lightning. | | DIRECTIVE | Type String Description The CSP directive that blocked the resource request. Possible Values - font-src - frame-src - img-src - media-src - style-src - script-src For information on these directives and a full list of all CSP directives, see [MDN Web Docs: Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy). | | DISPOSITION | Type String Description The CSP violation handling instruction for the user agent at the time of the violation. Possible Values - enforce—Enforce the policy violation. For violations with this DISPOSITION, the resource request was blocked. - report—Report the policy violation. For violations with this DISPOSITION, the resource request wasn’t blocked, but the violation was reported. | | EVENT\_TYPE | Type String Description The type of event. The value is always CspViolation | | LINE\_NUMBER | Type Number Description The line number in the document or worker script at which the violation occurred. This value is relevant only when DIRECTIVE is script-src. For those violations, use this value with COLUMN\_NUMBER to identify the location of the violation. Example 12 | | REQUEST\_ID | Type String Description The unique ID of a single transaction. A transaction can contain one or more events. Each event in a given transaction has the same REQUEST\_ID. Example 0000000062\_0000x8Lz- | | RESOURCE\_SAMPLE | Type String Description A sample of the resource that caused the violation, usually the first 40 characters, or the empty string. Example var lastRow = 4;greyLink('fRemoveRowLink var SFDCSessionVars={"server":"https:\\\\/\\\\ LoginHint.getSavedIdentities(false); LoginHint.saveHintEdit(); function handleLogin(){document.login.un… | | SOURCE | Type String Description The page where this CSP violation originated. For example, if your CSP policy prevented an image from loading on a Visualforce page, SOURCE contains the URL of that page. Example https://MyDomainName.my.salesforce.com/apex/HelloWorld | | SOURCE\_FILE | Type String Description The URL of the script in which the violation occurred. If the violation didn’t occur in a script, SOURCE\_FILE is null. Example https://www.example.com/script\_xyz.js | | TIMESTAMP | Type DateTime Description The access time of Salesforce services in GMT. Example 20220715233322.670 | | TIMESTAMP\_DERIVED | Type DateTime Description The access time of Salesforce services in ISO8601-compatible format (YYYY-MM-DDTHH:MM:SS.sssZ). The time zone is always GMT. Example 2022-07-27T11:32:59.555Z. | ## Usage Only one CSP violation event log file is available at a time. When the daily incremental event log file is generated during the daily background process, the new file replaces the existing file. If the event log file doesn’t exist, either the log generation process hasn’t run yet or there’s no violation data to report for that 24-hour window. The event log file is generated only when at least one violation occurred for the day. To collect CSP violation logs for multiple days, schedule a daily query of the CSP Violation event type via REST API. For example, you can configure a cron job in Unix or a scheduled task in Windows to run the query. #### See Also - [EventLogFile Supported Event Types](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_supportedeventtypes.htm "The EventType field in the EventLogFile object supports these events. Some common fields, such as CPU_TIME and RUN_TIME, can have null or zero values depending on how the events are generated for a given feature. Sometimes, three quotation marks appear around event data containing special characters in the CSV file. The third quotation mark is necessary for tools and applications to parse the field data at the correct field value boundary.") - [EventLogFile](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile.htm "Represents event log files generated by Event Monitoring. Use event log file data to analyze usage trends and user behavior in your Salesforce org. This object is available in API version 32.0 and later. The Interval and Sequence fields are available only in API version 37.0 and later.")