web/src/main/java/org/springframework/security/web/header/writers/HpkpHeaderWriter.java
public void setReportUri(String reportUri) {
		try {
			this.reportUri = new URI(reportUri);
		} catch (URISyntaxException e) {
			throw new IllegalArgumentException(e);
		}
		updateHpkpHeaderValue();
	}
public void setReportUri(String reportUri) {
		try {
			this.reportUri = new URI(reportUri);
		} catch (URISyntaxException e) {
			throw new IllegalArgumentException(e);
		}
		updateHpkpHeaderValue();
	}
<p>
Sets the URI to which the browser should report pin validation failures.
</p>

<p>
See <a href="https://tools.ietf.org/html/rfc7469#section-2.1.4">Section 2.1.4</a>
for additional details.
</p>

<p>
To get a header like

Public-Key-Pins-Report-Only: max-age=5184000;
pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g=";
pin-sha256="LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ=";
report-uri="https://other.example.net/pkp-report"

Use

HpkpHeaderWriter hpkpHeaderWriter = new HpkpHeaderWriter();
hpkpHeaderWriter.setReportUri("https://other.example.net/pkp-report");
</p>

@param reportUri the URI where the browser should send the report to.
@throws IllegalArgumentException if the reportUri is not a valid URI