Permissions-Policy-Report-Only and Reporting API updates

[hamishwillee]

This PR does a number of things:

1. adds the Permissions-Policy-Report-Only HTTP header, to complement the Permissions-Policy header. The headers are the same really, the only difference being that the report version does not enforce the policy and has a different disposition in reports.
   • Given that it doesn't make sense to redocument everything, especially in his case which has so much content.
   • I think this is a better model that what we did for the other policy docs - suggest we copy it for the other too (? for reviewer)
2. This then requires and update to cross link to Permissions-Policy and to the reporting object.
3. Then I updated the Reporting API. The main change is a restructure to put the Reporting Types first. I will be turning that into a table in ReportingAPI: List of reports - draft #43782
4. I also added a specific list in server endpoints of how you set the endpoint (moved out of the HTTP inteface section, as it is more general than that). This is useful as it shows how "diverse" the mechanisms are.

@chrisdavidmills I haven't checked this yet. Will take review, but might do a little tidy tomorrow.

[github-actions]

Preview URLs (6 pages)

• /en-US/docs/Web/API/CrashReportContext
• /en-US/docs/Web/API/CrashReport
• /en-US/docs/Web/API/PermissionsPolicyViolationReport
• /en-US/docs/Web/API/Reporting_API
• /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy-Report-Only
• /en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy

Flaws (1)

Note! 5 documents with no flaws that don't need to be listed. 🎉

Found an unexpected or unresolvable flaw? Please report it here.

URL: /en-US/docs/Web/API/CrashReportContext
Title: CrashReportContext
Flaw count: 1

• macros:
  • Macro domxref produces link /en-US/docs/Web/API/fetch which is a redirect

(comment last updated: 2026-04-21 06:57:08)

[chrisdavidmills]

@hamishwillee great work. I've got a few comments for you to look over, but nothing major. I definitely agree that this structure between a header and its report-only version is better.

[hamishwillee]

@chrisdavidmills Thanks for the review. I accepted all your suggestions bar one, which has a comment.

The only other change is I re-wrote this section on report types to have a clear list.

Note that this is the documented types. There are some I haven't tested yet, such as document policy and NetworkErrorReport. Those might require further updates - i.e. I have a feeling that NetworkErrorReport can't be sent to server endpoints so the text might need minor amendment.

I think this is good to go. Updating -Report-Only headers for other HTTP headers will be a separate task done right at the end.

[chrisdavidmills]

Yup, looks good to me.

[chrisdavidmills]

LGTM. Nice wce work, @hamishwillee.

[hamishwillee]

Thanks very much @chrisdavidmills . I feel like we're slowly getting there. I'm back on release tasks today, but once I have that in hand I'll look at Network errors, COOP reports, and Document-Policy.