CSP origins

CSP origins allow you to configure domains, or origins, that Qlik Sense client visualizations/extensions are allowed to communicate with.

Download OpenAPI spec

Endpoints

GET

/api/v1/csp-origins
POST

/api/v1/csp-origins
GET

/api/v1/csp-origins/{id}
PUT

/api/v1/csp-origins/{id}
DELETE

/api/v1/csp-origins/{id}
GET

/api/v1/csp-origins/actions/generate-header

Retrieves all content security policies for a tenant.

Facts

Rate limit

Tier 1 (1000 requests per minute)

Query Parameters

childSrc boolean

Filter resources by directive 'childSrc', true/false.
connectSrc boolean

Filter resources by directive 'connectSrc', true/false.
connectSrcWSS boolean

Filter resources by directive 'connectSrcWSS', true/false.
fontSrc boolean

Filter resources by directive 'fontSrc', true/false.
formAction boolean

Filter resources by directive 'formAction', true/false.
frameAncestors boolean

Filter resources by directive 'frameAncestors', true/false.
frameSrc boolean

Filter resources by directive 'frameSrc', true/false.
imgSrc boolean

Filter resources by directive 'imgSrc', true/false.
limit number

Maximum number of CSP-Origins to retrieve.

minimum = 1, maximum = 100, default = 20, default = 20
mediaSrc boolean

Filter resources by directive 'mediaSrc', true/false.
name string

Filter resources by name (wildcard and case insensitive).
next string

Cursor to the next page.
objectSrc boolean

Filter resources by directive 'objectSrc', true/false.
origin string

Filter resources by origin (wildcard and case insensitive).
prev string

Cursor to previous next page.
scriptSrc boolean

Filter resources by directive 'scriptSrc', true/false.
sort string

Field to sort by, prefix with -/+ to indicate order.

Can be one of: "name""-name""origin""-origin""createdDate""-createdDate""modifiedDate""-modifiedDate"
styleSrc boolean

Filter resources by directive 'styleSrc', true/false.
workerSrc boolean

Filter resources by directive 'workerSrc', true/false.

Responses

200

OK Response

application/json object
Show application/json properties
- data array of objects
  
  Show data properties
  
  id string
  
  The CSP entry's unique identifier.
  
  name string
  
  The name for this entry.
  
  maxLength = 512
  
  imgSrc boolean
  
  Specifies valid sources of images and favicons.
  
  origin string
  
  Required
  
  The origin that the CSP directives should be applied to.
  
  maxLength = 256
  
  fontSrc boolean
  
  Specifies valid sources for loading fonts.
  
  childSrc boolean
  
  Defines the valid sources for loading web workers and nested browsing contexts using elements such as frame and iFrame.
  
  frameSrc boolean
  
  Specifies valid sources for loading nested browsing contexts using elements such as frame and iFrame.
  
  mediaSrc boolean
  
  Specifies valid sources for loading media using the audio and video elements.
  
  styleSrc boolean
  
  Specifies valid sources for stylesheets.
  
  objectSrc boolean
  
  Specifies valid sources for the object, embed, and applet elements.
  
  scriptSrc boolean
  
  Specifies valid sources for JavaScript.
  
  workerSrc boolean
  
  Specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.
  
  connectSrc boolean
  
  Restricts the URLs that can be loaded using script interfaces.
  
  formAction boolean
  
  Allow forms to be submitted to the origin.
  
  createdDate string
  
  The UTC timestamp when the CSP entry was created.
  
  format = "date-time"
  
  description string
  
  The reason for adding this origin to the Content Security Policy.
  
  maxLength = 1024
  
  modifiedDate string
  
  The UTC timestamp when the CSP entry was last modified.
  
  format = "date-time"
  
  connectSrcWSS boolean
  
  Restricts the URLs that can be connected to websockets (all sources will be prefixed with 'wss://').
  
  frameAncestors boolean
  
  Specifies valid sources for embedding the resource using frame, iFrame, object, embed and applet.
- links object
  
  Show links properties
  
  next object
  
  Show next properties
  
  href string
  
  Required
  
  URL to a resource request.
  
  prev object
  
  Show prev properties
  
  href string
  
  Required
  
  URL to a resource request.
  
  self object
  
  Show self properties
  
  href string
  
  Required
  
  URL to a resource request.

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

403

Forbidden

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

GET /api/v1/csp-origins

import { createQlikApi } from '@qlik/api'

const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})

await qlik.cspOrigins.getCSPEntries({})

qlik csp-origin ls

curl "https://{tenant}.{region}.qlikcloud.com/api/v1/csp-origins" \
-H "Authorization: Bearer <access_token>"

Example Response

{
  "data": [
    {
      "name": "string",
      "imgSrc": true,
      "origin": "string",
      "fontSrc": true,
      "childSrc": true,
      "frameSrc": true,
      "mediaSrc": true,
      "styleSrc": true,
      "objectSrc": true,
      "scriptSrc": true,
      "workerSrc": true,
      "connectSrc": true,
      "formAction": true,
      "createdDate": "2018-10-30T07:06:22Z",
      "description": "string",
      "modifiedDate": "2018-10-30T07:06:22Z",
      "connectSrcWSS": true,
      "frameAncestors": true,
      "id": "string"
    }
  ],
  "links": {
    "next": {
      "href": "string"
    },
    "prev": {
      "href": "string"
    },
    "self": {
      "href": "string"
    }
  }
}

Creates a new content security policy for an origin.

Facts

Rate limit

Tier 2 (100 requests per minute)

Request Body

Required

application/json object
Show application/json properties
- name string
  
  The name for this entry.
  
  maxLength = 512
- imgSrc boolean
  
  Specifies valid sources of images and favicons.
- origin string
  
  Required
  
  The origin that the CSP directives should be applied to.
  
  maxLength = 256
- fontSrc boolean
  
  Specifies valid sources for loading fonts.
- childSrc boolean
  
  Defines the valid sources for loading web workers and nested browsing contexts using elements such as frame and iFrame.
- frameSrc boolean
  
  Specifies valid sources for loading nested browsing contexts using elements such as frame and iFrame.
- mediaSrc boolean
  
  Specifies valid sources for loading media using the audio and video elements.
- styleSrc boolean
  
  Specifies valid sources for stylesheets.
- objectSrc boolean
  
  Specifies valid sources for the object, embed, and applet elements.
- scriptSrc boolean
  
  Specifies valid sources for JavaScript.
- workerSrc boolean
  
  Specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.
- connectSrc boolean
  
  Restricts the URLs that can be loaded using script interfaces.
- formAction boolean
  
  Allow forms to be submitted to the origin.
- description string
  
  The reason for adding this origin to the Content Security Policy.
  
  maxLength = 1024
- connectSrcWSS boolean
  
  Restricts the URLs that can be connected to websockets (all sources will be prefixed with 'wss://').
- frameAncestors boolean
  
  Specifies valid sources for embedding the resource using frame, iFrame, object, embed and applet.

Responses

201

OK Response

application/json object
Show application/json properties
- id string
  
  The CSP entry's unique identifier.
- name string
  
  The name for this entry.
  
  maxLength = 512
- imgSrc boolean
  
  Specifies valid sources of images and favicons.
- origin string
  
  Required
  
  The origin that the CSP directives should be applied to.
  
  maxLength = 256
- fontSrc boolean
  
  Specifies valid sources for loading fonts.
- childSrc boolean
  
  Defines the valid sources for loading web workers and nested browsing contexts using elements such as frame and iFrame.
- frameSrc boolean
  
  Specifies valid sources for loading nested browsing contexts using elements such as frame and iFrame.
- mediaSrc boolean
  
  Specifies valid sources for loading media using the audio and video elements.
- styleSrc boolean
  
  Specifies valid sources for stylesheets.
- objectSrc boolean
  
  Specifies valid sources for the object, embed, and applet elements.
- scriptSrc boolean
  
  Specifies valid sources for JavaScript.
- workerSrc boolean
  
  Specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.
- connectSrc boolean
  
  Restricts the URLs that can be loaded using script interfaces.
- formAction boolean
  
  Allow forms to be submitted to the origin.
- createdDate string
  
  The UTC timestamp when the CSP entry was created.
  
  format = "date-time"
- description string
  
  The reason for adding this origin to the Content Security Policy.
  
  maxLength = 1024
- modifiedDate string
  
  The UTC timestamp when the CSP entry was last modified.
  
  format = "date-time"
- connectSrcWSS boolean
  
  Restricts the URLs that can be connected to websockets (all sources will be prefixed with 'wss://').
- frameAncestors boolean
  
  Specifies valid sources for embedding the resource using frame, iFrame, object, embed and applet.

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

403

Forbidden

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

POST /api/v1/csp-origins

import { createQlikApi } from '@qlik/api'

const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})

await qlik.cspOrigins.createCSPEntry({
  childSrc: true,
  connectSrc: true,
  connectSrcWSS: true,
  description: 'string',
  fontSrc: true,
  formAction: true,
  frameAncestors: true,
  frameSrc: true,
  imgSrc: true,
  mediaSrc: true,
  name: 'string',
  objectSrc: true,
  origin: 'string',
  scriptSrc: true,
  styleSrc: true,
  workerSrc: true,
})

qlik csp-origin create \
  --origin 'string'

curl "https://{tenant}.{region}.qlikcloud.com/api/v1/csp-origins" \
-X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer <access_token>" \
-d '{"name":"string","imgSrc":true,"origin":"string","fontSrc":true,"childSrc":true,"frameSrc":true,"mediaSrc":true,"styleSrc":true,"objectSrc":true,"scriptSrc":true,"workerSrc":true,"connectSrc":true,"formAction":true,"description":"string","connectSrcWSS":true,"frameAncestors":true}'

Example Response

{
  "name": "string",
  "imgSrc": true,
  "origin": "string",
  "fontSrc": true,
  "childSrc": true,
  "frameSrc": true,
  "mediaSrc": true,
  "styleSrc": true,
  "objectSrc": true,
  "scriptSrc": true,
  "workerSrc": true,
  "connectSrc": true,
  "formAction": true,
  "createdDate": "2018-10-30T07:06:22Z",
  "description": "string",
  "modifiedDate": "2018-10-30T07:06:22Z",
  "connectSrcWSS": true,
  "frameAncestors": true,
  "id": "string"
}

Returns details for a specific content security policy.

Facts

Rate limit

Tier 1 (1000 requests per minute)

Path Parameters

id string

Required

The CSP entry's unique identifier.

Responses

200

OK Response

application/json object
Show application/json properties
- id string
  
  The CSP entry's unique identifier.
- name string
  
  The name for this entry.
  
  maxLength = 512
- imgSrc boolean
  
  Specifies valid sources of images and favicons.
- origin string
  
  Required
  
  The origin that the CSP directives should be applied to.
  
  maxLength = 256
- fontSrc boolean
  
  Specifies valid sources for loading fonts.
- childSrc boolean
  
  Defines the valid sources for loading web workers and nested browsing contexts using elements such as frame and iFrame.
- frameSrc boolean
  
  Specifies valid sources for loading nested browsing contexts using elements such as frame and iFrame.
- mediaSrc boolean
  
  Specifies valid sources for loading media using the audio and video elements.
- styleSrc boolean
  
  Specifies valid sources for stylesheets.
- objectSrc boolean
  
  Specifies valid sources for the object, embed, and applet elements.
- scriptSrc boolean
  
  Specifies valid sources for JavaScript.
- workerSrc boolean
  
  Specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.
- connectSrc boolean
  
  Restricts the URLs that can be loaded using script interfaces.
- formAction boolean
  
  Allow forms to be submitted to the origin.
- createdDate string
  
  The UTC timestamp when the CSP entry was created.
  
  format = "date-time"
- description string
  
  The reason for adding this origin to the Content Security Policy.
  
  maxLength = 1024
- modifiedDate string
  
  The UTC timestamp when the CSP entry was last modified.
  
  format = "date-time"
- connectSrcWSS boolean
  
  Restricts the URLs that can be connected to websockets (all sources will be prefixed with 'wss://').
- frameAncestors boolean
  
  Specifies valid sources for embedding the resource using frame, iFrame, object, embed and applet.

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

403

Forbidden

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

404

Not found

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

GET /api/v1/csp-origins/{id}

import { createQlikApi } from '@qlik/api'

const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})

await qlik.cspOrigins.getCSPEntry('string')

qlik csp-origin get 'string'

curl "https://{tenant}.{region}.qlikcloud.com/api/v1/csp-origins/{id}" \
-H "Authorization: Bearer <access_token>"

Example Response

{
  "name": "string",
  "imgSrc": true,
  "origin": "string",
  "fontSrc": true,
  "childSrc": true,
  "frameSrc": true,
  "mediaSrc": true,
  "styleSrc": true,
  "objectSrc": true,
  "scriptSrc": true,
  "workerSrc": true,
  "connectSrc": true,
  "formAction": true,
  "createdDate": "2018-10-30T07:06:22Z",
  "description": "string",
  "modifiedDate": "2018-10-30T07:06:22Z",
  "connectSrcWSS": true,
  "frameAncestors": true,
  "id": "string"
}

Updates a content security policy.

Facts

Rate limit

Tier 2 (100 requests per minute)

Path Parameters

id string

Required

The CSP entry's unique identifier.

Request Body

Required

application/json object
Show application/json properties
- name string
  
  The name for this entry.
  
  maxLength = 512
- imgSrc boolean
  
  Specifies valid sources of images and favicons.
- origin string
  
  Required
  
  The origin that the CSP directives should be applied to.
  
  maxLength = 256
- fontSrc boolean
  
  Specifies valid sources for loading fonts.
- childSrc boolean
  
  Defines the valid sources for loading web workers and nested browsing contexts using elements such as frame and iFrame.
- frameSrc boolean
  
  Specifies valid sources for loading nested browsing contexts using elements such as frame and iFrame.
- mediaSrc boolean
  
  Specifies valid sources for loading media using the audio and video elements.
- styleSrc boolean
  
  Specifies valid sources for stylesheets.
- objectSrc boolean
  
  Specifies valid sources for the object, embed, and applet elements.
- scriptSrc boolean
  
  Specifies valid sources for JavaScript.
- workerSrc boolean
  
  Specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.
- connectSrc boolean
  
  Restricts the URLs that can be loaded using script interfaces.
- formAction boolean
  
  Allow forms to be submitted to the origin.
- description string
  
  The reason for adding this origin to the Content Security Policy.
  
  maxLength = 1024
- connectSrcWSS boolean
  
  Restricts the URLs that can be connected to websockets (all sources will be prefixed with 'wss://').
- frameAncestors boolean
  
  Specifies valid sources for embedding the resource using frame, iFrame, object, embed and applet.

Responses

200

OK Response

application/json object
Show application/json properties
- id string
  
  The CSP entry's unique identifier.
- name string
  
  The name for this entry.
  
  maxLength = 512
- imgSrc boolean
  
  Specifies valid sources of images and favicons.
- origin string
  
  Required
  
  The origin that the CSP directives should be applied to.
  
  maxLength = 256
- fontSrc boolean
  
  Specifies valid sources for loading fonts.
- childSrc boolean
  
  Defines the valid sources for loading web workers and nested browsing contexts using elements such as frame and iFrame.
- frameSrc boolean
  
  Specifies valid sources for loading nested browsing contexts using elements such as frame and iFrame.
- mediaSrc boolean
  
  Specifies valid sources for loading media using the audio and video elements.
- styleSrc boolean
  
  Specifies valid sources for stylesheets.
- objectSrc boolean
  
  Specifies valid sources for the object, embed, and applet elements.
- scriptSrc boolean
  
  Specifies valid sources for JavaScript.
- workerSrc boolean
  
  Specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.
- connectSrc boolean
  
  Restricts the URLs that can be loaded using script interfaces.
- formAction boolean
  
  Allow forms to be submitted to the origin.
- createdDate string
  
  The UTC timestamp when the CSP entry was created.
  
  format = "date-time"
- description string
  
  The reason for adding this origin to the Content Security Policy.
  
  maxLength = 1024
- modifiedDate string
  
  The UTC timestamp when the CSP entry was last modified.
  
  format = "date-time"
- connectSrcWSS boolean
  
  Restricts the URLs that can be connected to websockets (all sources will be prefixed with 'wss://').
- frameAncestors boolean
  
  Specifies valid sources for embedding the resource using frame, iFrame, object, embed and applet.

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

403

Forbidden

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

404

Not found

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

PUT /api/v1/csp-origins/{id}

import { createQlikApi } from '@qlik/api'

const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})

await qlik.cspOrigins.updateCSPEntry('string', {
  childSrc: true,
  connectSrc: true,
  connectSrcWSS: true,
  description: 'string',
  fontSrc: true,
  formAction: true,
  frameAncestors: true,
  frameSrc: true,
  imgSrc: true,
  mediaSrc: true,
  name: 'string',
  objectSrc: true,
  origin: 'string',
  scriptSrc: true,
  styleSrc: true,
  workerSrc: true,
})

qlik csp-origin update 'string' \
  --origin 'string'

curl "https://{tenant}.{region}.qlikcloud.com/api/v1/csp-origins/{id}" \
-X PUT \
-H "Content-type: application/json" \
-H "Authorization: Bearer <access_token>" \
-d '{"name":"string","imgSrc":true,"origin":"string","fontSrc":true,"childSrc":true,"frameSrc":true,"mediaSrc":true,"styleSrc":true,"objectSrc":true,"scriptSrc":true,"workerSrc":true,"connectSrc":true,"formAction":true,"description":"string","connectSrcWSS":true,"frameAncestors":true}'

Example Response

{
  "name": "string",
  "imgSrc": true,
  "origin": "string",
  "fontSrc": true,
  "childSrc": true,
  "frameSrc": true,
  "mediaSrc": true,
  "styleSrc": true,
  "objectSrc": true,
  "scriptSrc": true,
  "workerSrc": true,
  "connectSrc": true,
  "formAction": true,
  "createdDate": "2018-10-30T07:06:22Z",
  "description": "string",
  "modifiedDate": "2018-10-30T07:06:22Z",
  "connectSrcWSS": true,
  "frameAncestors": true,
  "id": "string"
}

Deletes a specific content security policy.

Facts

Rate limit

Tier 2 (100 requests per minute)

Path Parameters

id string

Required

The CSP entry's unique identifier.

Responses

204

No Content response.

400

Bad Request

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

403

Forbidden

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

404

Not found

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

DELETE /api/v1/csp-origins/{id}

import { createQlikApi } from '@qlik/api'

const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})

await qlik.cspOrigins.deleteCSPEntry('string')

qlik csp-origin rm 'string'

curl "https://{tenant}.{region}.qlikcloud.com/api/v1/csp-origins/{id}" \
-X DELETE \
-H "Authorization: Bearer <access_token>"

Retrieves the full content security policy header (including all configured policies and origins) for the tenant.

Facts

Rate limit

Tier 1 (1000 requests per minute)

Header Parameters

Accept string

The Accept request HTTP header indicates which content types, expressed as MIME types, the client is able to understand

Can be one of: "application/json""text/plain"
default = "application/json"

Responses

200

OK Response

text/plain string

200

OK Response

application/json object
Show application/json properties
- Content-Security-Policy string
  
  The compiled CSP header.

401

Unauthorized

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

406

Not Acceptable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

500

Internal Server Error

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

503

Service Unavailable

application/json object
Show application/json properties
- errors array of objects
  
  Show errors properties
  
  code string
  
  Required
  
  The unique code for the error.
  
  title string
  
  Required
  
  A summary of what went wrong.
  
  detail string
  
  May be used to provide additional details.

GET /api/v1/csp-origins/actions/generate-header

import { createQlikApi } from '@qlik/api'

const qlik = createQlikApi({
  hostConfig: {
    host: 'https://{tenant}.{region}.qlikcloud.com',
    apiKey: '<access-token>',
  },
})

await qlik.cspOrigins.getCSPHeader()

qlik csp-origin generate-header

curl "https://{tenant}.{region}.qlikcloud.com/api/v1/csp-origins/actions/generate-header" \
-H "Authorization: Bearer <access_token>"

Example Response

string

CSP origins

Endpoints

List CSPs

Facts

Query Parameters

Responses

200

400

401

403

500

503

Example Response

Create a new CSP

Facts

Request Body

Responses

201

400

401

403

500

503

Example Response

Get a CSP

Facts

Path Parameters

Responses

200

400

401

403

404

500

503

Example Response

Update a CSP

Facts

Path Parameters

Request Body

Responses

200

400

401

403

404

500

503

Example Response

Delete a CSP

Facts

Path Parameters

Responses

204

400

401

403

404

500

503

Retrieve CSP header

Facts

Header Parameters

Responses

200

200

401

406

500

503

Example Response