Locale dictionaries load on demand (CSP connect-src)

To keep the HAPI Elements SDK smaller, English UI strings ship with the SDK script. Other supported locales (de, nl, fr, es, it) are fetched on demand from the same Elements origin as your loader (for example https://elements.hapi.vonq.com or https://elements-sandbox.hapi.vonq.com) when the active locale changes.

What partners need to do

Nothing, if you already follow the documented CSP block in Setting Up / Integrating HAPI Elements:

connect-src 'self' https://*.vonq-aws.com https://*.vonq.com

That connect-src already allows the host-page SDK to fetch locale JSON from the Elements origin.

When you need a CSP change

Tighten or customize connect-src carefully:

• If your policy does not allow https://*.vonq.com (or your environment’s Elements host), add the exact Elements origin you use for loader.js / injector.js to connect-src.
• A blocked locale fetch leaves non-English UI on English (or empty) until the request succeeds — check the browser console for CSP / network errors to the Elements origin’s /locales/… URLs.

You do not need to configure an Elements origin yourself for this: the loader already points the SDK at the correct host for your environment.

Notes

• Widget iframe content and API calls continue to use the same Elements / HAPI hosts as before.
• Translation keys and the language SDK surface (window.hapi.language…) are unchanged; only how non-English dictionaries are delivered to the host page changes.
• No translation keys were removed.