{"uid":"cap_Jd8vTm13I4cmk_EIfraJ2","slug":"forest-web-cors-preflight-inspector-d890a728","name":"Forest Web CORS Preflight Inspector","description":"Machine-readable contract for active Forest paid capabilities. Unsigned paid calls return HTTP 402 with a PAYMENT-REQUIRED x402 challenge.","url":"https://http--forest-gas-station-mainnet--lcjl27p8lmjs.code.run/cors/preflight?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","pattern":"^https?://","maxLength":2048,"minLength":1,"description":"Public HTTP(S) URL to inspect, resolve, or compare."},"origin":{"type":"string","pattern":"^https?://","maxLength":2048,"minLength":1,"description":"Public origin value used to scope this lookup."},"requested_method":{"type":"string","maxLength":32,"minLength":1,"description":"Public requested method value used to scope this lookup."},"requested_headers":{"type":"array","items":{"type":"string","maxLength":128,"minLength":1},"maxItems":20,"description":"Public requested headers value used to scope this lookup."}}},"responseSchema":{"type":"json","example":{"ok":true,"data":{"scope":"observed_noncredentialed_cors_preflight_only","status":100,"blockers":[],"warnings":[],"final_url":"example","allowed_origin":"example","method_allowed":false,"origin_allowed":false,"redirect_count":0,"allowed_headers":[],"allowed_methods":[],"headers_allowed":false,"preflight_passes":false,"credentials_allowed":false,"provider_request_count":1},"meta":{"cache":"miss","provider":"safe-http-options","checked_at":"2026-01-01T00:00:00.000Z","duration_ms":0},"version":"1","capability":"cors.preflight"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_zuRjgdIzjd8ebbarIH-pa","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Sends a single CORS OPTIONS preflight request to a public URL and normalizes the Access-Control-Allow-* response into structured origin, method, and header permission decisions.","exampleAgentPrompt":"Can you check whether https://api.example.com/data allows CORS preflight requests from https://myapp.com using GET and the Authorization header?","exampleUseCases":[{"title":"Verify third-party API CORS policy","prompt":"I want to call https://api.openweathermap.org/data/2.5/weather from my web app at https://myapp.com — can you do a CORS preflight check to see if it allows GET requests with an Authorization header?"},{"title":"Debug cross-origin fetch failure","prompt":"My frontend at https://dashboard.acme.com is getting blocked when trying to POST to https://api.partner.com/submit with Content-Type headers — can you preflight that URL for my origin and tell me exactly what CORS rules it declares?"},{"title":"Audit public API before integration","prompt":"Before I integrate https://public-data-api.gov/records into my browser app at https://explorer.mysite.com, can you check what methods and headers it allows via CORS so I know what my requests can include?"}],"resultDescription":"Returns a normalized breakdown of the CORS preflight response: whether the target URL allows the specified origin, which HTTP methods are permitted, which request headers are allowed, and the raw Access-Control-Allow-* header values observed. The result reflects only what the server declared in the OPTIONS response at the exact URL — no redirects are followed and no cookies or credentials are sent.","failureModes":["Target URL is unreachable or returns a network error — no CORS data returned","Server does not respond to OPTIONS requests — may indicate CORS is not supported","Redirect encountered — Forest does not follow redirects, so the CORS state of the final destination is not reported","Malformed or missing Access-Control-Allow-* headers — normalized result may show denial or undefined policy","URL does not match required http/https pattern — request rejected with validation error","Requested headers list exceeds 20 items — input rejected"],"whenToPreferThis":"Choose this endpoint when you need a lightweight, non-invasive check of a URL's CORS policy before attempting a browser-side cross-origin fetch. It is ideal for pre-integration audits, debugging CORS errors, or validating that a third-party API will accept requests from a specific origin with particular methods and headers. It is not suitable when you need to follow redirects, test credentialed (cookie/Authorization) requests, verify actual resource responses, or execute JavaScript-dependent behavior.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-20T12:41:37.733Z","isFirstParty":false,"canonicalSlug":"forest-web-cors-preflight-inspector-d890a728"}