CSP header for API endpoints

[cosieLq]

Hi,

I'm implementing CSP header for API endpoints and have seen default-src 'none'; frame-ancestors 'none' recommended as the value for this header: https://infosec.mozilla.org/guidelines/web_security#content-security-policy

However, when I run several scanning tests on https://observatory.mozilla.org, it's said that base-uri and form-action are missing.
My question is: are these two directives necessary for API endpoints? Thank you!