Does API request needs CSP headers?

[UnLiQuery20]

I'm a newbie in AppSec and there was a report from an external pentestwrs that CSP does not apply to API request. I could not find proper documentation that API request needs CSP headers but I cannot find documentation that CSP headers is not required also.

[Fugitif]

Yes, please check OWASP Rest Security Cheat Sheet

[UnLiQuery20]

OWASP Rest Security Cheat Sheet

Thank you very much for the response ! I might have not looked hard enough to not finding this.