{"uid":"cap__uHAq_6_vTQncAyBTT3GA","slug":"cors-origin-check-f25b4a7d","name":"CORS Origin Check","description":"CORS Origin Check: CORS Origin Check compares a request origin with explicit allowed origins from bounded caller-supplied values without an external provider. Call CORS Origin Check before accepting, caching, redirecting, or retrying a caller-supplied web response. Returns normalized web evidence, the computed finding, and an explicit pass or advisory status for CORS Origin Check as versioned deterministic JSON. Price: $0.001 USDC via x402 on Base. First-party, stateless, memory-only execution…","url":"https://api.delx.ai/api/v1/x402/cors-origin-check","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"origin":{"type":"string","maxLength":8192,"description":"Origin supplied to CORS Origin Check; used only for this bounded calculation and processed in memory without retention."},"allowed":{"type":"array","items":{"type":"string","maxLength":8192},"maxItems":256,"description":"Allowed supplied to CORS Origin Check; used only for this bounded calculation and processed in memory without retention."},"credentials":{"type":"boolean","description":"Credentials supplied to CORS Origin Check; used only for this bounded calculation and processed in memory without retention."}}},"responseSchema":{"type":"json","example":{"result":{"origin":"https://app.example.com/","allowed":true,"credentials":true},"schema":"delx/util-cors-origin-check/v1","status":"pass","evidence":{"retained":false,"input_sha256":"502a62c83d87812324c4b1fe1a2a0df77db850e0a6e49fef68313499e8d02d82","external_calls":0},"operation":"web_reliability:cors_origin_check"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_kJbPEQQkksV7Aos9sS5L6","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates whether a request origin is in an explicit list of allowed origins and returns a deterministic pass/advisory finding for CORS policy enforcement.","exampleAgentPrompt":"Check whether the origin 'https://app.example.com' is allowed by CORS policy given the allowed list ['https://app.example.com', 'https://admin.example.com'] with credentials enabled, and tell me if it passes.","exampleUseCases":[{"title":"API gateway origin enforcement","prompt":"Before I accept this incoming request, check if the origin 'https://partner.acme.com' is in my allowed CORS origins list — ['https://partner.acme.com', 'https://dashboard.acme.com'] — with credentials set to false. Do I let it through?"},{"title":"Credential-bearing CORS pre-flight validation","prompt":"I'm getting a preflight CORS request from 'https://checkout.mystore.com' with credentials enabled. My allowed origins are ['https://checkout.mystore.com', 'https://www.mystore.com']. Run a CORS origin check and tell me if this should pass."},{"title":"Cache response gate on CORS compliance","prompt":"Before I cache this web response, verify that the origin 'https://widget.thirdparty.io' is allowed — my whitelist is ['https://trusted.myapp.io'] — credentials false. Give me the deterministic finding so I know whether to proceed."}],"resultDescription":"Returns versioned deterministic JSON containing: normalized web evidence of the origin and allowed-list inputs, the computed CORS finding (whether the origin matches any allowed entry, and credentials compatibility), and an explicit pass or advisory status indicating whether the request origin should be accepted.","failureModes":["Origin or allowed list missing from request body — returns validation error","Allowed list exceeds 256 items — rejected by schema constraint","Wildcard origin patterns may not be evaluated as regex — only exact string matching","Malformed origin URL may result in normalization advisory rather than hard pass","Non-boolean credentials field — schema type error"],"whenToPreferThis":"Choose this endpoint when you need a stateless, deterministic, auditable CORS origin check without any external dependencies or API keys — particularly useful in agent pipelines that must gate on CORS compliance before accepting, caching, redirecting, or retrying a caller-supplied web response. Prefer it over custom code when you need versioned, reproducible JSON evidence of the CORS decision for logging or compliance purposes.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T01:11:44.689Z","isFirstParty":false}