{"uid":"cap_7GSf72spNoFXjvgKh3Q-E","slug":"webschutz-cors-policy-evidence-checker-3208666a","name":"Webschutz CORS Policy Evidence Checker","description":"No accidental wildcard CORS evidence record fetches current public evidence from the supplied target and evaluates the documented criterion. It returns the observation, threshold, verdict, exact evidence source, limitations and a mode-specific action. The check is passive: no login attempt, payload injection, exploit, purchase, form submission or load test is performed.","url":"https://webschutz.halowerk.com/v1/cors-policy-evidence?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"target":{"type":"string","maxLength":2048,"minLength":3,"description":"Public HTTP(S) URL or domain to inspect. A bare domain is normalized to HTTPS."},"context":{"type":"object","description":"Optional non-secret correlation labels returned unchanged only in the request lifecycle.","maxProperties":12,"additionalProperties":{"type":["string","number","boolean","null"]}},"baseline":{"type":["object","null"],"description":"Optional baseline returned by a previous snapshot call.","additionalProperties":true},"compare_url":{"type":"string","maxLength":2048,"minLength":3,"description":"Optional public comparison URL. Used by change and monitoring services."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Wnt6T5mTtHPRqWYpBGhkY","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Passively fetches and evaluates current public CORS policy evidence from a target URL to detect accidental wildcard CORS misconfigurations","exampleAgentPrompt":"Can you check whether https://api.example.com has an accidental wildcard CORS misconfiguration — I just want a passive evidence-based verdict, no active exploiting or login attempts.","exampleUseCases":[{"title":"Pre-launch CORS security audit","prompt":"Before we go live, can you passively inspect https://staging.myapp.com for any accidental wildcard CORS headers and give me the verdict with evidence?"},{"title":"Third-party vendor security review","prompt":"We're integrating with https://api.vendorservice.io — can you check their CORS policy for wildcard misconfigurations and tell me what evidence you found?"},{"title":"Continuous CORS drift monitoring","prompt":"Compare the current CORS policy evidence on https://api.myplatform.com against this baseline snapshot I captured last week and tell me if anything has changed."}],"resultDescription":"Returns the observed CORS policy details, the evaluated threshold, a pass/fail verdict, the exact evidence source URL, known limitations of the passive check, and a mode-specific recommended action. No credentials or exploits are used — the check is entirely passive.","failureModes":["Target URL is unreachable or returns a non-2xx status — endpoint may return an error or inconclusive verdict","Target blocks external HTTP probes, leading to incomplete evidence","Bare domain normalization to HTTPS fails if the site only supports HTTP","Malformed or overly long target URL exceeds the 2048-character limit","Comparison URL unavailable causes change-detection mode to fail","Rate limits or network timeouts may result in partial evidence"],"whenToPreferThis":"Choose this endpoint when you need a passive, non-intrusive check for wildcard CORS misconfigurations on a public HTTP(S) target — it is ideal for pre-launch audits, vendor security reviews, or automated CORS drift monitoring without any risk of triggering WAFs, authentication systems, or load tests. Prefer this over generic HTTP header inspection tools when you specifically need structured CORS policy evidence, a clear verdict, and actionable remediation guidance.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-22T18:38:27.553Z","isFirstParty":false,"canonicalSlug":"webschutz-cors-policy-evidence-checker-3208666a"}