CspTrustedSite

Represents a trusted URL. For each CspTrustedSite, you can specify Content Security Policy (CSP) directives and permissions policy directives. Each CSP directive allows Lightning components, third-party APIs, and WebSocket connections to access a resource type from the trusted URL. If the Permissions-Policy HTTP header is enabled, each permissions policy directive grants the trusted URL access to a browser feature. In API version 58.0 and earlier, CspTrustedSite included only CSP directives and was referred to as CSP Trusted Sites in Salesforce Setup.

Version 

Introduced in API version 39.0.

Supported SOAP API Calls 

create(), delete(), describeLayout(), describeSObjects(), query(), retrieve(), update(), upsert()

Supported REST API Methods 

DELETE, GET, HEAD, PATCH, POST, Query

Limitations 

SOQL Limitations

SOSL Limitations

Fields 

CanAccessCamera 

• Type: boolean

• Required: No

• Properties: Create, Defaulted on create, Filter, Group, Sort, Update

• Introduced: API version 59.0

• Description: Indicates whether this CspTrustedSite can access the user’s camera (true) or not (false). The default value is false.

This field takes effect only when the enablePermissionsPolicy field equals true and the grantCameraAccess field equals TrustedUrls in the SecuritySettings metadata API type.

• Default value: false

CanAccessMicrophone 

• Type: boolean

• Required: No

• Properties: Create, Defaulted on create, Filter, Group, Sort, Update

• Introduced: API version 59.0

• Description: Indicates whether this CspTrustedSite can access the user’s microphone (true) or not (false). The default value is false.

This field takes effect only when the enablePermissionsPolicy field equals true and the grantMicrophoneAccess field equals TrustedUrls in the SecuritySettings metadata API type.

• Default value: false

Context 

• Type: picklist

• Required: No

• Properties: Create, Filter, Group, Restricted picklist, Sort, Update

• Introduced: API version 44.0

• Description: Declares the scope of the CSP directives for the trusted URL.

For custom Visualforce pages, content is restricted to trusted URLs only if the page’s cspHeader attribute is set to true.

• Possible values:

  • All — All — Apply the CSP directives to all supported context types.

  • LEX — Lightning Experience Pages — Apply the CSP directives to Lightning Experience only.

  • Communities — Experience Builder Sites — Apply the CSP directives to Experience Builder sites only.

  • FieldServiceMobileExtension — Field Service Mobile Extension — Apply the CSP directives to the Field Service Mobile Extensions only. Available in API version 47.0 and later.

  • LightningOut — Lightning Out — Reserved for future use. Available in API version 64.0 and later

  • VisualForce — Visualforce Pages — Apply the CSP directives to custom Visualforce pages only. Available in API version 55.0 and later.

Description 

• Type: textarea

• Required: No

• Properties: Create, Filter, Group, Nillable, Sort, Update

• Description: The description of this trusted URL.

DeveloperName 

• Type: string

• Required: No

• Properties: Create, Filter, Group, Sort, Update

• Description: The unique name for the Trusted URL object.

EndpointUrl 

• Type: string

• Required: No

• Properties: Create, Filter, Group, Sort, Update

• Description: Required. The URL for this CspTrustedSite.

• This field must include a domain name and can include a port. For example, https://example.com or https://example.com:8080. To reduce repetition, you can use the wildcard character * (asterisk). For example, *.example.com.

Don’t include placeholders or invalid characters. For example, don’t use malformed^url.example.com, and https://{subdomain}.example.com.

• For a third-party API, the URL must begin with https://. For example, https://example.com.
• For a WebSocket connection, the URL must begin with wss://. For example, wss://example.com.
• For a Chrome extension, use the 32-character extension ID in the format chrome-extension://abcdefghijklmnopabcdefghijklmnop. The ID can contain only lowercase letters a–p. Wildcards aren’t supported in Chrome extension URIs.

Before February 2025, it was possible to save a malformed URL. Malformed URLs are excluded from generated CSP HTTP headers. To keep your Trusted URLs list accurate, remove any malformed entries. You can use an Apex class to find all malformed URLs. See the knowledge article, Identify Malformed Trusted URLs.

IsActive 

• Type: boolean

• Required: No

• Properties: Create, Defaulted on create, Filter, Group, Sort, Update

• Description: Indicates whether this CspTrustedSite is active (true) or not (false). The default value is true.

• Default value: false

IsApplicableToConnectSrc 

• Type: boolean

• Required: No

• Properties: Create, Defaulted on create, Filter, Group, Sort, Update

• Introduced: API version 48.0

• Description: Indicates whether Lightning components, third-party APIs, and WebSocket connections can load URLs using script interfaces from this trusted URL (true) or not (false). This field has a default value of false.

• Default value: false

IsApplicableToFontSrc 

• Type: boolean

• Required: No

• Properties: Create, Defaulted on create, Filter, Group, Sort, Update

• Introduced: API version 48.0

• Description: Indicates whether Lightning components, third-party APIs, and WebSocket connections can load fonts from this trusted URL (true) or not (false).

• Default value: false

IsApplicableToFrameSrc 

• Type: boolean

• Required: No

• Properties: Create, Defaulted on create, Filter, Group, Sort, Update

• Introduced: API version 48.0

• Description: Indicates whether Lightning components, third-party APIs, and WebSocket connections can load resources contained in <iframe> elements from this trusted URL (true) or not (false). This field has a default value of false.

• Default value: false

IsApplicableToImgSrc 

• Type: boolean

• Required: No

• Properties: Create, Defaulted on create, Filter, Group, Sort, Update

• Introduced: API version 48.0

• Description: Indicates whether Lightning components, third-party APIs, and WebSocket connections can load images from this trusted URL (true) or not (false). This field has a default value of false.

• Default value: false

IsApplicableToMediaSrc 

• Type: boolean

• Required: No

• Properties: Create, Defaulted on create, Filter, Group, Sort, Update

• Introduced: API version 48.0

• Description: Indicates whether Lightning components, third-party APIs, and WebSocket connections can load audio and video from this trusted URL (true) or not (false). This field has a default value of false.

• Default value: false

IsApplicableToStyleSrc 

• Type: boolean

• Required: No

• Properties: Create, Defaulted on create, Filter, Group, Sort, Update

• Introduced: API version 48.0

• Description: Indicates whether Lightning components, third-party APIs, and WebSocket connections can load style sheets from this trusted URL (true) or not (false). This field has a default value of false.

• Default value: false

Language 

• Type: picklist

• Required: No

• Properties: Create, Defaulted on create, Filter, Group, Nillable, Restricted picklist, Sort, Update

• Description: The language of the Trusted URL.

• Possible values:

  • en_US — English

  • de — German

  • es — Spanish

  • fr — French

  • it — Italian

  • ja — Japanese

  • sv — Swedish

  • ko — Korean

  • zh_TW — Chinese (Traditional)

  • zh_CN — Chinese (Simplified)

  • pt_BR — Portuguese (Brazil)

  • nl_NL — Dutch

  • da — Danish

  • th — Thai

  • fi — Finnish

  • ru — Russian

  • es_MX — Spanish (Mexico)

  • no — Norwegian

ManageableState 

• Type: picklist

• Required: No

• Properties: Filter, Group, Nillable, Restricted picklist, Sort

• Description: Indicates the manageable state of the specified component that is contained in a package.

• Possible values:

  • beta — beta

  • deleted — deleted

  • deprecated — deprecated

  • deprecatedEditable — deprecatedEditable

  • installed — installed

  • installedEditable — installedEditable

  • released — released

  • unmanaged — unmanaged

MasterLabel 

• Type: string

• Required: No

• Properties: Create, Filter, Group, Sort, Update

• Description: Label for the Trusted URL. In the UI, this field is MasterLabel.

MobileExtensionId 

• Type: ID
• Required: No
• Properties: Filter, Group, Nillable, Sort
• Introduced: API version 48.0

NamespacePrefix 

• Type: string

• Required: No

• Properties: Filter, Group, Nillable, Sort

• Description: The namespace prefix associated with this object. Each Developer Edition organization that creates a managed package has a unique namespace prefix. Limit: 15 characters. You can refer to a component in a managed package by using the namespacePrefix__componentName notation.

The namespace prefix can have one of the following values:

• In Developer Edition organizations, the namespace prefix is set to the namespace prefix of the organization for all objects that support it. There is an exception if an object is in an installed managed package. In that case, the object has the namespace prefix of the installed managed package. This field’s value is the namespace prefix of the Developer Edition organization of the package developer.
• In organizations that are not Developer Edition organizations, NamespacePrefix is only set for objects that are part of an installed managed package. There is no namespace prefix for all other objects.

Usage 

For each CSPTrustedSite, at least one field starting with grantAccess or isApplicableTo must be set to true.

In API versions 50.0 to 58.0, if all isApplicable fields are false, the isApplicableToImgSrc field is set to true. In API version 49.0 and earlier, if all isApplicable fields are false, those fields all default to true.

To ensure smooth integration across Salesforce products, Salesforce includes URLs in each of the CSP directives that correspond to the isApplicable fields, even though those URLs aren’t defined as CspTrustedSite components. Salesforce regularly updates those URLs based on the latest requirements.