{"uid":"cap_94Kkd5qJUVvX7zMBsxYn3","slug":"webschutz-cors-policy-decision-ced43db8","name":"WebSchutz CORS Policy Decision","description":"No accidental wildcard CORS decision fetches current public evidence from the supplied target and evaluates the documented criterion. It returns the observation, threshold, verdict, exact evidence source, limitations and a mode-specific action. The check is passive: no login attempt, payload injection, exploit, purchase, form submission or load test is performed.","url":"https://webschutz.halowerk.com/v1/cors-policy-decision?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"target":{"type":"string","maxLength":2048,"minLength":3,"description":"Public HTTP(S) URL or domain to inspect. A bare domain is normalized to HTTPS."},"context":{"type":"object","description":"Optional non-secret correlation labels returned unchanged only in the request lifecycle.","maxProperties":12,"additionalProperties":{"type":["string","number","boolean","null"]}},"baseline":{"type":["object","null"],"description":"Optional baseline returned by a previous snapshot call.","additionalProperties":true},"compare_url":{"type":"string","maxLength":2048,"minLength":3,"description":"Optional public comparison URL. Used by change and monitoring services."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_prITf6N1ARcvabEfL2zXn","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Passively fetches and evaluates the CORS policy of a public URL to determine whether an accidental wildcard or misconfigured CORS header is present, returning a structured verdict with evidence and recommendations.","exampleAgentPrompt":"Can you passively check whether https://api.example.com has an accidental wildcard CORS misconfiguration and give me the verdict, the actual evidence from the headers, and what I should do about it?","exampleUseCases":[{"title":"Pre-launch API security check","prompt":"Before we go live, can you check https://api.myapp.com for any accidental wildcard CORS settings and tell me what the headers actually say and whether we're at risk?"},{"title":"Third-party vendor CORS audit","prompt":"I need to verify the CORS policy on https://partner-api.vendorsite.com — can you inspect it passively and let me know if they're exposing a wildcard that could affect our integration?"},{"title":"Continuous CORS change monitoring","prompt":"Compare the current CORS policy on https://staging.myplatform.io against the baseline snapshot I captured last week and tell me if anything changed or got more permissive."}],"resultDescription":"Returns a structured JSON object containing: the observed CORS header value, the evaluated threshold criterion, a pass/fail/warning verdict, the exact evidence source (e.g. response header from the target), any limitations of the passive check, and a mode-specific recommended action. No credentials, exploits, or form submissions are made during inspection.","failureModes":["Target URL is unreachable or returns a non-public response — endpoint cannot retrieve evidence","Target domain does not respond with any CORS headers — observation will note absence","Invalid or malformed URL input — returns validation error","Target server blocks automated header inspection — evidence may be incomplete","Rate limiting or network timeouts on the target side — may result in inconclusive verdict"],"whenToPreferThis":"Choose this endpoint when you need a passive, non-intrusive, evidence-based evaluation of a specific URL's CORS policy — especially when you want a structured verdict (pass/fail/warning) with traceable evidence rather than a raw header dump. Prefer this over generic HTTP header inspection tools when the specific concern is wildcard CORS misconfiguration and you need actionable remediation guidance baked into the response.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-22T18:31:09.388Z","isFirstParty":false,"canonicalSlug":"webschutz-cors-policy-decision-ced43db8"}