{"uid":"cap_By4Ag0j-PZ0LigOeczxdN","slug":"cors-header-checker-e29cf193","name":"CORS Header Checker","description":"Sends a real request to any URL you provide, attaches an Origin header, and reads back all six standard cross-origin permission headers the server returns. Tells you whether cross-origin requests are enabled at all, whether your specific origin is permitted, and shows every permission value exactly as the server sent it. Useful for finding why a browser is blocking a request, confirming a new deployment is configured correctly, or auditing whether a public API allows credentialed calls.","url":"https://cors-header-checker.underscoredone.com/check?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","description":"The full web address of the endpoint you want to check — must start with http:// or https://."},"origin":{"type":"string","description":"The website address you want to test cross-origin access from, for example https://myapp.com. Defaults to https://example.com if you leave it out."}}},"responseSchema":{"type":"json","example":{"url":"https://api.github.com","error":"","status":200,"headers":{"access-control-max-age":null,"access-control-allow-origin":"https://github.com","access-control-allow-headers":null,"access-control-allow-methods":null,"access-control-expose-headers":"ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset","access-control-allow-credentials":null},"api_version":"1.0.0","cors_enabled":true,"origin_tested":"https://myapp.com","origin_allowed":false}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_2Xx1NmMTbJPNWVH8lGHeV","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Sends a real HTTP request to a URL with a specified Origin header and returns all six standard CORS response headers plus a summary of whether cross-origin access is enabled and whether the tested origin is permitted.","exampleAgentPrompt":"Can you check whether https://api.stripe.com allows cross-origin requests from https://myapp.com — specifically whether that origin is permitted and whether credentialed requests are allowed?","exampleUseCases":null,"resultDescription":"A JSON object containing the target URL, HTTP status code of the probe request, a boolean cors_enabled flag, the tested origin string, an origin_allowed boolean, and the raw values of all six CORS headers (access-control-allow-origin, access-control-allow-methods, access-control-allow-headers, access-control-allow-credentials, access-control-expose-headers, access-control-max-age) exactly as the server returned them, plus any error message if the request failed.","failureModes":["Target URL is unreachable or times out — error field contains the failure reason","URL is malformed or missing http/https prefix — request rejected before being sent","Target server returns no CORS headers — cors_enabled will be false and all header values null","Network-level block prevents the probe from reaching the target — error populated","Origin parameter is omitted — defaults to https://example.com which may not reflect real-world behavior"],"whenToPreferThis":"Use this endpoint when you need to know the exact CORS headers a live server returns at runtime, rather than inferring from documentation. It is ideal for debugging browser CORS errors, post-deployment verification of CORS configuration, or auditing third-party APIs for cross-origin policy compliance. Prefer it over manual curl commands when you need the result programmatically with parsed fields like cors_enabled and origin_allowed.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T06:36:30.695Z","isFirstParty":false,"canonicalSlug":"cors-header-checker-e29cf193"}