Name: CSP Evaluator API: Content Security Policy Checker
Brand: glowhalo
SKU: api-glowhalo-csp-evaluator-api
Availability: InStock
Author: API Market

# CSP Evaluator API

## Overview

The CSP Evaluator API finds the weak points in a website's Content Security Policy that undermine script-injection protection. Give it a URL and it fetches the page once, reads the Content-Security-Policy and Content-Security-Policy-Report-Only headers and the meta tag policies, and returns one graded JSON report: a verdict, a script protection level, a grade from A+ to F and coded issues, each linked to the W3C CSP Level 3 section it is based on.

Unlike web-based evaluators you read by eye, it returns JSON with stable issue codes, and an offline validate endpoint checks a policy string before you deploy it. It is a static assessment of the policy text, so a clean report is not a security guarantee, and policies injected at runtime are not seen. Not affiliated with the W3C, Google or any browser vendor.

## Features

*   **2 endpoints**: Evaluate a live URL, or a policy string you supply (offline, nothing is fetched).
*   **Header and meta policies**: Reads `Content-Security-Policy`, `Content-Security-Policy-Report-Only` and `<meta http-equiv>` policies from the HTML head.
*   **Script protection level**: `strict`, `allowlist`, `none` or `unknown`, based on nonces, hashes, `'strict-dynamic'` and host allowlists.
*   **Missing hardening directives**: Flags missing `object-src`, `base-uri` and `frame-ancestors` and permissive `form-action`.
*   **Dangerous sources**: Flags `'unsafe-inline'`, `'unsafe-eval'`, wildcards, `data:` and `http:` sources and known allowlist bypass hosts.
*   **Coded findings**: Stable `code` values with a severity and a W3C specification link.
*   **Multiple policies**: Comma-separated policies are evaluated as the browser applies them.
*   **Caching**: Results are cached for 15 minutes; `fresh=1` bypasses the cache.

## Use Cases

*   **Security audits**: Check the CSP of every client or vendor site and list the weak points.
*   **CI pipelines**: Fail a build when a new error appears, using the offline validate endpoint on a policy before deploy.
*   **Site scanners**: Add a CSP section with stable codes to a scanner or monitoring product.
*   **Rollout checks**: Verify a Report-Only policy before you enforce it.
*   **Monitoring**: Re-check key URLs on a schedule and alert when a policy is removed or weakened.

## API Documentation

### Base URL

All requests go through the API.market gateway at this base URL:

```
https://prod.api.market/api/v1/glowhalo/csp-evaluator-api
```

### Authentication

Every request needs your API.market key in the `x-api-market-key` header:

```
x-api-market-key: YOUR_API_KEY
```

Replace `YOUR_API_KEY` with your actual API key.

### Endpoints

#### 1. Evaluate a site's Content Security Policy

Fetches the page once (up to 5 redirects, first 1 MB, 10 second timeout, private networks refused), collects the `Content-Security-Policy` and `Content-Security-Policy-Report-Only` response headers and the `<meta http-equiv>` policies in the HTML head, and evaluates each policy against W3C Content Security Policy Level 3. Returns a `verdict`, a `scriptProtection` level, a grade, the parsed policies and issues. A value without a scheme such as `example.com` is treated as https. Results are cached for 15 minutes.

**Method:** `GET`

**Endpoint:** `/v1/check`

**Parameters:**

| Name | In | Description | Type | Required |
|---|---|---|---|---|
| `url` | query | Page to check, for example `https://example.com`. The aliases `u`, `uri`, `link`, `target`, `site`, `website`, `domain` and `host` are also accepted. | string | Yes |
| `fresh` | query | Set to `1` to bypass the 15-minute cache. | string | No |

**Example Request:**

```bash
curl -s "https://prod.api.market/api/v1/glowhalo/csp-evaluator-api/v1/check?url=https://example.com" \
  -H "x-api-market-key: YOUR_API_KEY"
```

**Example Response (abridged):**

```json
{
  "verdict": "no_csp",
  "scriptProtection": "none",
  "grade": "F",
  "summary": { "errors": 1, "warnings": 0, "infos": 0 },
  "policies": [],
  "issues": [
    { "severity": "error", "code": "csp_missing", "docs": "https://www.w3.org/TR/CSP3/" }
  ]
}
```

#### 2. Evaluate a policy string you send in

Runs the same evaluation offline on a policy you send in. Nothing is fetched, so it works for policies you have not deployed yet. Several policies may be separated by commas, as in a header with multiple policies. Maximum body 64 KB.

**Method:** `POST`

**Endpoint:** `/v1/validate`

**Body:** JSON with `policy` (required), `delivery` (`header` or `meta`), `reportOnly` (boolean) and `xFrameOptions`. In a meta tag `frame-ancestors`, `report-uri` and `sandbox` have no effect.

**Example Request:**

```bash
curl -s -X POST "https://prod.api.market/api/v1/glowhalo/csp-evaluator-api/v1/validate" \
  -H "x-api-market-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"policy": "default-src '\''self'\''; script-src '\''self'\'' '\''unsafe-inline'\'' https:; object-src '\''none'\''", "delivery": "header", "reportOnly": false}'
```

**Example Response (200 OK):**

```json
{
  "delivery": "header",
  "reportOnly": false,
  "enforced": true,
  "verdict": "enforced",
  "scriptProtection": "none",
  "grade": "F",
  "score": 44,
  "summary": {
    "errors": 1,
    "warnings": 3,
    "infos": 1
  },
  "policies": [
    {
      "index": 1,
      "delivery": "header",
      "reportOnly": false,
      "enforced": true,
      "raw": "default-src 'self'; script-src 'self' 'unsafe-inline' https:; object-src 'none'",
      "directives": [
        {
          "name": "default-src",
          "values": [
            "'self'"
          ]
        },
        {
          "name": "script-src",
          "values": [
            "'self'",
            "'unsafe-inline'",
            "https:"
          ]
        },
        {
          "name": "object-src",
          "values": [
            "'none'"
          ]
        }
      ],
      "grade": "F",
      "score": 44
    }
  ],
  "issues": [
    {
      "severity": "error",
      "code": "script_unsafe_inline",
      "message": "script-src allows 'unsafe-inline' without a nonce or hash, so inline <script> blocks and event handlers run. This removes most of the XSS protection CSP provides. Basis: W3C Content Security Policy Level 3, \"'unsafe-inline' keyword-source\".",
      "directive": "script-src",
      "policy": 1,
      "docs": "https://www.w3.org/TR/CSP3/#grammardef-unsafe-inline"
    },
    {
      "severity": "warning",
      "code": "script_https_scheme_source",
      "message": "script-src allows the https: scheme, which permits scripts from every HTTPS host and defeats the allowlist. Basis: W3C Content Security Policy Level 3, \"Matching URLs to source expressions\".",
      "directive": "script-src",
      "policy": 1,
      "docs": "https://www.w3.org/TR/CSP3/#match-url-to-source-expression"
    },
    {
      "severity": "warning",
      "code": "base_uri_missing",
      "message": "base-uri is not set and does not fall back to default-src, so an injected <base> tag can redirect every relative script URL. Set base-uri 'none' or 'self'. Basis: W3C Content Security Policy Level 3, \"base-uri\".",
      "docs": "https://www.w3.org/TR/CSP3/#directive-base-uri"
    },
    {
      "severity": "warning",
      "code": "frame_ancestors_missing",
      "message": "No frame-ancestors directive is delivered in an HTTP header, so CSP does not control who may embed the page in a frame. Without it or X-Frame-Options the page may be open to clickjacking. Basis: W3C Content Security Policy Level 3, \"frame-ancestors\".",
      "docs": "https://www.w3.org/TR/CSP3/#directive-frame-ancestors"
    },
    {
      "severity": "info",
      "code": "form_action_missing",
      "message": "form-action is not set and does not fall back to default-src, so forms can submit to any origin. Basis: W3C Content Security Policy Level 3, \"form-action\".",
      "docs": "https://www.w3.org/TR/CSP3/#directive-form-action"
    }
  ],
  "assumptions": {
    "note": "Validated offline: only the policy text was analyzed, nothing was fetched."
  },
  "checkedAt": "2026-10-21T06:38:19.196Z",
  "note": "Evaluates the Content Security Policy that the page declares in its HTTP response headers (Content-Security-Policy and Content-Security-Policy-Report-Only) and in <meta http-equiv> tags in the HTML head, using the W3C Content Security Policy Level 3 rules. The page is fetched with this API's own user agent, so a site that serves different headers to other clients can look different to real browsers. Policies set by scripts at runtime are not seen. Findings are static analysis of the policy text: they do not prove that a page is exploitable or safe, and a clean report is not a security guarantee."
}
```

### Issue codes

Every issue has a stable `code`, a `severity`, a message that names the evidence and, for almost all codes, a `docs` link to the W3C CSP Level 3 section it is based on. The same code can appear with a different severity depending on where it occurs (for example `script_allowlist_only` is a warning for a host allowlist and info for a bare `'self'`). Findings in a Report-Only policy are lowered by one severity level and flagged with `reportOnly: true`.

**Errors:** `csp_missing`, `no_enforced_policy`, `script_src_missing`, `script_unsafe_inline`, `script_wildcard_source`, `script_http_scheme_source`, `script_data_uri`, `strict_dynamic_without_nonce_or_hash`, `keyword_missing_quotes`.

**Warnings (selection):** `object_src_missing`, `base_uri_missing`, `frame_ancestors_missing`, `script_unsafe_eval`, `script_https_scheme_source`, `script_known_bypass_host`, `script_allowlist_only`, `nonce_too_short`, `policy_truncated`, `directive_typo`, `unknown_directive`, `duplicate_directive`, `meta_unsupported_directive`, `report_only_without_reporting`, `http_error_status`.

**Infos (selection):** `form_action_missing`, `default_src_missing`, `style_unsafe_inline`, `deprecated_directive`, `report_only_policy_present`, `legacy_csp_header`.

The complete list of codes is the `issues[].code` enum in the response schema. Verdict values: `enforced`, `report_only`, `no_csp`, `ineffective`, `unknown`. Script protection values: `strict`, `allowlist`, `none`, `unknown`.

## Status Codes

| Code | Meaning |
|---|---|
| 200 | The report was produced. |
| 400 | Bad input (for example `missing_url`, `invalid_url`, `forbidden_host` for private-network targets). The body has `error`, `message` and a usage hint. |
| 404 | Route not found. |
| 413 | `payload_too_large` on `/v1/validate` (body over 64 KB). |
| 502 | `fetch_failed`: the target page could not be fetched. |
| 429 | The trial or monthly quota is used up (hard limit). Back off before retrying and honour any `Retry-After` header. |

## Rate Limits

The Free trial includes 500 requests. The Basic plan includes 25,000 requests per month as a hard limit: when the quota is used up the API returns `429 Too Many Requests` instead of billing overage.

## FAQ

**Is this a security scanner?**

No. It is a static assessment of the Content Security Policy text. It does not prove that a site is vulnerable or safe, and a clean report is not a security guarantee.

**Does it see policies that scripts add at runtime?**

No. It reads the response headers and the meta tags in the HTML head (up to the first 1 MB). A policy that JavaScript injects later is not seen.

**What does `scriptProtection` mean?**

`strict` means scripts are guarded by nonces or hashes, `allowlist` means only a host allowlist guards them, `none` means no effective script protection and `unknown` means it could not be determined (for example the policy was truncated or the page returned an error status).

**How are several policies handled?**

A comma separates separate policies, as the browser applies them. The strongest policy sets the grade and the weaknesses of the others are reported as info.

**How are the grade and score calculated?**

100 minus 25 per error, 10 per warning and 1 per info (at most 5), mapped to A+ 97, A 90, B 80, C 70, D 60, F. A page with no enforced policy is capped at a score of 40. Report-Only findings are listed but not scored when an enforced policy exists.

**Is it affiliated with Google or the W3C?**

No. The rules are implemented from the W3C Content Security Policy Level 3 specification. The API is not affiliated with the W3C, Google or any browser vendor.

## Contact Us

If you have any questions or need assistance, you can reach out to us through the embedded chat on the bottom right corner of the page or send an email to hello@magicapi.com.


CSP evaluator API that reads a URL's Content-Security-Policy header and meta tag and returns a verdict, script protection level, grade and coded issues.

CSP Evaluator API: Content Security Policy Checker