Content Security Policy Settings

BETA: This API resource is not finalized, and there could be breaking changes before its final release.

API for enabling/disabling the use of Content Security Policy headers and configuring allowed domains

Get current settings for account or course

CspSettingsController#get_csp_settings

BETA: This API endpoint is not finalized, and there could be breaking changes before its final release.

GET /api/v1/courses/:course_id/csp_settings

Scope: url:GET|/api/v1/courses/:course_id/csp_settings

GET /api/v1/accounts/:account_id/csp_settings

Scope: url:GET|/api/v1/accounts/:account_id/csp_settings

Update multiple modules in an account.

API response field:

• enabled

Whether CSP is enabled.

• inherited

Whether the current CSP settings are inherited from a parent account.

• settings_locked

Whether current CSP settings can be overridden by sub-accounts and courses.

• effective_whitelist

If enabled, lists the currently allowed domains (includes domains automatically allowed through external tools).

• tools_whitelist

(Account-only) Lists the automatically allowed domains with their respective external tools

• current_account_whitelist

(Account-only) Lists the current list of domains explicitly allowed by this account. (Note: this list will not take effect unless CSP is explicitly enabled on this account)

Enable, disable, or clear explicit CSP setting

CspSettingsController#set_csp_setting

BETA: This API endpoint is not finalized, and there could be breaking changes before its final release.

PUT /api/v1/courses/:course_id/csp_settings

Scope: url:PUT|/api/v1/courses/:course_id/csp_settings

PUT /api/v1/accounts/:account_id/csp_settings

Scope: url:PUT|/api/v1/accounts/:account_id/csp_settings

Either explicitly sets CSP to be on or off for courses and sub-accounts, or clear the explicit settings to default to those set by a parent account

Note: If “inherited” and “settings_locked” are both true for this account or course, then the CSP setting cannot be modified.

Request Parameters:

Parameter	Type	Description
status	Required string	If set to “enabled” for an account, CSP will be enabled for all its courses and sub-accounts (that have not explicitly enabled or disabled it), using the allowed domains set on this account. If set to “disabled”, CSP will be disabled for this account or course and for all sub-accounts that have not explicitly re-enabled it. If set to “inherited”, this account or course will reset to the default state where CSP settings are inherited from the first parent account to have them explicitly set. Allowed values: enabled, disabled, inherited

Lock or unlock current CSP settings for sub-accounts and courses

CspSettingsController#set_csp_lock

BETA: This API endpoint is not finalized, and there could be breaking changes before its final release.

PUT /api/v1/accounts/:account_id/csp_settings/lock

Scope: url:PUT|/api/v1/accounts/:account_id/csp_settings/lock

Can only be set if CSP is explicitly enabled or disabled on this account (i.e. “inherited” is false).

Request Parameters:

Parameter	Type	Description
settings_locked	Required boolean	Whether sub-accounts and courses will be prevented from overriding settings inherited from this account.

Add an allowed domain to account

CspSettingsController#add_domain

BETA: This API endpoint is not finalized, and there could be breaking changes before its final release.

POST /api/v1/accounts/:account_id/csp_settings/domains

Scope: url:POST|/api/v1/accounts/:account_id/csp_settings/domains

Adds an allowed domain for the current account. Note: this will not take effect unless CSP is explicitly enabled on this account.

Request Parameters:

Parameter	Type	Description
domain	Required string	no description

Add multiple allowed domains to an account

CspSettingsController#add_multiple_domains

BETA: This API endpoint is not finalized, and there could be breaking changes before its final release.

POST /api/v1/accounts/:account_id/csp_settings/domains/batch_create

Scope: url:POST|/api/v1/accounts/:account_id/csp_settings/domains/batch_create

Adds multiple allowed domains for the current account. Note: this will not take effect unless CSP is explicitly enabled on this account.

Request Parameters:

Parameter	Type	Description
domains	Required Array	no description

Remove a domain from account

CspSettingsController#remove_domain

BETA: This API endpoint is not finalized, and there could be breaking changes before its final release.

DELETE /api/v1/accounts/:account_id/csp_settings/domains

Scope: url:DELETE|/api/v1/accounts/:account_id/csp_settings/domains

Removes an allowed domain from the current account.

Request Parameters:

Parameter	Type	Description
domain	Required string	no description

---

This documentation is generated directly from the Canvas LMS source code, available on Github.