{"uid":"cap_Et1YiKNCGjLF-0QglssZd","slug":"webschutz-cors-policy-audit-acf0864e","name":"WebSchutz CORS Policy Audit","description":"No accidental wildcard CORS audit fetches current public evidence from the supplied target and evaluates the documented criterion. It returns the observation, threshold, verdict, exact evidence source, limitations and a mode-specific action. The check is passive: no login attempt, payload injection, exploit, purchase, form submission or load test is performed.","url":"https://webschutz.halowerk.com/v1/cors-policy-audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"target":{"type":"string","maxLength":2048,"minLength":3,"description":"Public HTTP(S) URL or domain to inspect. A bare domain is normalized to HTTPS."},"context":{"type":"object","description":"Optional non-secret correlation labels returned unchanged only in the request lifecycle.","maxProperties":12,"additionalProperties":{"type":["string","number","boolean","null"]}},"baseline":{"type":["object","null"],"description":"Optional baseline returned by a previous snapshot call.","additionalProperties":true},"compare_url":{"type":"string","maxLength":2048,"minLength":3,"description":"Optional public comparison URL. Used by change and monitoring services."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_RY8h92-t3HUeuWa9q2rlb","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Passively audits a public URL or domain for accidental wildcard CORS misconfigurations and returns verdict, evidence, and remediation guidance","exampleAgentPrompt":"Can you do a passive CORS policy audit on https://api.example.com and tell me if it has any accidental wildcard CORS misconfiguration — I want the verdict, the exact evidence, and what I should do about it?","exampleUseCases":[{"title":"Pre-launch API security check","prompt":"Before we go live, can you audit https://api.myapp.com for wildcard CORS misconfigurations and give me the verdict plus any evidence you find?"},{"title":"Continuous CORS drift monitoring","prompt":"Compare the CORS policy on https://staging.myservice.com against the baseline from last week's snapshot — tell me if anything has changed and whether there's now a wildcard exposure."},{"title":"Third-party vendor CORS vetting","prompt":"I need to verify that https://partner-api.vendor.com doesn't have an accidental open CORS policy before we integrate it — can you run a passive CORS audit and give me the full findings?"}],"resultDescription":"Returns an observation describing detected CORS headers, a threshold defining what constitutes a violation, a pass/fail verdict, the exact evidence source (e.g. response header value), known limitations of the passive check, and a mode-specific recommended action. If a baseline or comparison URL was supplied, a change or drift assessment is also included.","failureModes":["Target URL is unreachable or returns a non-public response — audit cannot be completed","Target domain resolves but server returns no CORS headers — observation reflects absence of policy","Malformed or excessively long target URL exceeds 2048-character limit — request rejected with validation error","Target behind authentication or firewall — passive check cannot retrieve headers","Rate limit exceeded for the endpoint — request rejected"],"whenToPreferThis":"Choose this endpoint when you need a passive, non-intrusive, evidence-backed CORS misconfiguration check on a public URL without performing any login, payload injection, or active exploit. It is ideal for pre-launch security reviews, continuous monitoring pipelines comparing against a stored baseline, or vetting third-party API endpoints before integration. Prefer this over generic security scanners when you specifically need CORS wildcard detection with structured verdict and remediation guidance.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-21T18:30:50.571Z","isFirstParty":false,"canonicalSlug":"webschutz-cors-policy-audit-acf0864e"}