files/en-us/web/http/reference/headers/permissions-policy/xr-spatial-tracking/index.md
{{SeeCompatTable}}
The HTTP {{HTTPHeader("Permissions-Policy")}} header xr-spatial-tracking directive controls whether the current document is allowed to use the WebXR Device API.
Specifically, where a defined policy blocks usage of this feature:
{{DOMxRef("XRSystem/isSessionSupported","navigator.xr.isSessionSupported()")}} and {{DOMxRef("XRSystem/requestSession","navigator.xr.requestSession()")}} calls will return a {{jsxref("Promise")}} that rejects with a {{domxref("DOMException")}} of type SecurityError.
{{domxref("XRSystem/devicechange_event", "devicechange")}} events are not fired on the {{DOMxRef("Navigator.xr","navigator.xr")}} object.
Permissions-Policy: xr-spatial-tracking=<allowlist>;
<allowlist>
Permissions-Policy > Syntax for more details.The default allowlist for xr-spatial-tracking is self.
{{Specifications}}
{{Compat}}