# HTTP Security Headers API

Apply and manage HTTP security headers for SAP-branded `view` and `click` domains.

This API supports create, read, update, and delete (CRUD) operations. Image and CloudPage domains aren't supported.

## Available Headers

The HTTP Security Headers API supports a discrete set of header and value pairs. Developers select which headers to
apply from these nine options.

| Header                      | Value                                                   |
| --------------------------- | ------------------------------------------------------- |
| `Content-Security-Policy`   | default-src 'self'; frame-ancestors 'self'              |
| `X-Frame-Options`           | SAMEORIGIN                                              |
| `X-Content-Type-Options`    | nosniff                                                 |
| `Referrer-Policy`           | origin-when-cross-origin                                |
| `Strict-Transport-Security` | max-age=31536000; includeSubDomains                     |
| `Cache-Control`             | no-cache, must-revalidate, max-age=0, no-store, private |
| `X-XSS-Protection`          | 1; mode=block                                           |
| `Permissions-Policy`        | geolocation=(self), microphone=()                       |
| `Set-Cookie`                | strict                                                  |

:::note
The `Content-Security-Policy` sometimes breaks external content when applied to `view` domains. For example, it's possible to break an image that's hosted on another domain.
Test your pages to ensure that your content renders as intended.
:::

## Base URI

In this base URI example, the abbreviation {tse} is a placeholder that occupies the place of the tenant-specific-endpoint for the account.

```http
https://{tse}.rest.marketingcloudapis.com/
```

## Supported Use Cases

| Function                                                                                                                | Method | Route                                    | Permissions                      |
| ----------------------------------------------------------------------------------------------------------------------- | ------ | ---------------------------------------- | -------------------------------- |
| [Get All HTTP Security Headers](/docs/marketing/marketing-cloud/references/mc_rest_security/securityHeaders-get-all.md) | GET    | /messaging/v1/securityHeaders/all        | Security > HTTP Headers > View   |
| [Get HTTP Security Headers](/docs/marketing/marketing-cloud/references/mc_rest_security/securityHeaders-read.md)        | GET    | /messaging/v1/securityHeaders            | Security > HTTP Headers > View   |
| [Update HTTP Security Headers](/docs/marketing/marketing-cloud/references/mc_rest_security/securityHeaders-update.md)   | POST   | /messaging/v1/securityHeaders            | Security > HTTP Headers > Update |
| [Delete HTTP Security Headers](/docs/marketing/marketing-cloud/references/mc_rest_security/securityHeaders-delete.md)   | DELETE | /messaging/v1/securityHeaders/{PageType} | Security > HTTP Headers > Delete |

## Error Handling

This API uses the standard error status codes outlined on the [Handle Errors in REST API page](/docs/marketing/marketing-cloud/guide/error-handling.md).

## Related Items

- [Sender Authentication Package](https://help.salesforce.com/s/articleView?id=mktg.mc_es_sender_authentication_package.htm)
- [Set Up Your Development Environment for Enhanced Packages](/docs/marketing/marketing-cloud/guide/mc-dev-setup-enhanced.md)
- [HTTP Headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers)
- [Handle Errors in REST API page](/docs/marketing/marketing-cloud/guide/error-handling.md)