{"uid":"cap_9s01geK-25gbU841jbTx6","slug":"lordevo-cors-check-500323a8","name":"Lordevo CORS Check","description":"SEO audits, website security checks, SEO content plans, articles and site fix plans as API endpoints for AI agents. Pay per request in USDC on Base with…","url":"https://shop.lordevo.com/api/quick/cors-check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["url"],"properties":{"url":{"type":"string","description":"Public http(s) URL or bare domain, e.g. https://example.com"},"method":{"enum":["GET","POST","PUT","PATCH","DELETE"],"type":"string","default":"GET","description":"Method for the preflight"},"origin":{"type":"string","default":"https://example.com","pattern":"^https?://[a-zA-Z0-9.-]+(:\\d{1,5})?$","description":"Origin to test, e.g. https://app.example.com"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["tool","url","allowed"],"properties":{"url":{"type":"string"},"tool":{"type":"string"},"issues":{"type":"array"},"origin":{"type":"string"},"allowed":{"type":"boolean"},"allow_origin":{"type":["string","null"]},"allow_credentials":{"type":"boolean"},"reflects_arbitrary_origin":{"type":["boolean","null"]}}}}}}},"responseSchema":{"type":"json","example":{"url":"https://api.example.com/v1/items","tool":"cors-check","issues":[],"method":"GET","origin":"https://app.example.com","allowed":true,"vary_origin":true,"allow_origin":"https://app.example.com","allow_methods":"GET, POST","preflight_status":204,"allow_credentials":true,"reflects_arbitrary_origin":false}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_zPIBcusVP3IMTqRpwaeUl","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Tests whether a browser on a given origin can call a target URL by sending a CORS preflight (OPTIONS) and GET request, then reporting CORS headers, security flags, and permission verdicts.","exampleAgentPrompt":"Can you check if my frontend at https://app.mycompany.com is allowed to make GET requests to https://api.thirdparty.com/data — specifically run the CORS preflight and tell me if the origin is allowed, whether credentials are permitted, and flag any security issues like arbitrary-origin reflection?","exampleUseCases":[{"title":"Diagnosing blocked browser fetch","prompt":"My React app at https://dashboard.acme.com keeps getting CORS errors when calling https://api.partner.com/v2/orders with GET requests — can you run a CORS check and tell me exactly what headers are returned and whether my origin is allowed?"},{"title":"Security audit for wildcard CORS","prompt":"I need to check if https://api.publicservice.io reflects arbitrary origins or uses a wildcard Access-Control-Allow-Origin — can you probe it from the origin https://evil.example.com and flag any CORS security issues?"},{"title":"Verifying credentials support for cross-origin auth","prompt":"Before I ship this feature, can you verify that https://auth.internal.io/session allows CORS requests with credentials from https://app.internal.io, and confirm what methods and headers are permitted?"}],"resultDescription":"A JSON object containing: the target URL and tested origin, an `allowed` boolean indicating whether the browser would be permitted, the raw `Access-Control-Allow-Origin` value, `allow_credentials` boolean, `allow_methods` string, `preflight_status` code, `vary_origin` boolean, `reflects_arbitrary_origin` flag, and an `issues` array listing detected CORS security problems.","failureModes":["Target URL is unreachable or returns a non-HTTP error — endpoint may return a network error or timeout","Invalid URL format — returns a validation error","Target server does not respond to OPTIONS preflight — preflight_status may be null or unexpected","No CORS headers returned — `allowed` is false and `allow_origin` is null","Rate-limit or 402 payment required if the x402 payment is not processed correctly"],"whenToPreferThis":"Use this endpoint when you need a live, real-time CORS preflight test for a specific URL and origin combination — especially when debugging browser fetch failures, auditing third-party APIs for CORS misconfigurations, or checking for dangerous security patterns like arbitrary-origin reflection or wildcard credentials. Prefer this over manual browser DevTools inspection when automating security checks in pipelines or agent workflows.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:40:10.498Z","isFirstParty":false,"canonicalSlug":"lordevo-cors-check-500323a8"}