{"uid":"cap_nHbxk_lLx3MPlt22zsE39","slug":"cors-preflight-check-86061418","name":"CORS Preflight Check","description":"CORS Preflight Check: CORS Preflight Check checks requested method and headers against a CORS preflight policy from bounded caller-supplied values without an external provider. Call CORS Preflight Check before accepting, caching, redirecting, or retrying a caller-supplied web response. Returns normalized web evidence, the computed finding, and an explicit pass or advisory status for CORS Preflight Check as versioned deterministic JSON. Price: $0.001 USDC via x402 on Base. First-party, stateless…","url":"https://api.delx.ai/api/v1/x402/cors-preflight-check?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"method":{"type":"string","maxLength":8192,"description":"Method supplied to CORS Preflight Check; used only for this bounded calculation and processed in memory without retention."},"allowed_headers":{"type":"array","items":{"type":"string","maxLength":8192},"maxItems":256,"description":"Allowed Headers supplied to CORS Preflight Check; used only for this bounded calculation and processed in memory without retention."},"allowed_methods":{"type":"array","items":{"type":"string","maxLength":8192},"maxItems":256,"description":"Allowed Methods supplied to CORS Preflight Check; used only for this bounded calculation and processed in memory without retention."},"request_headers":{"type":"array","items":{"type":"string","maxLength":8192},"maxItems":256,"description":"Request Headers supplied to CORS Preflight Check; used only for this bounded calculation and processed in memory without retention."}}},"responseSchema":{"type":"json","example":{"result":{"allowed":true,"method_allowed":true,"missing_headers":[]},"schema":"delx/util-cors-preflight-check/v1","status":"pass","evidence":{"retained":false,"input_sha256":"571002a70ff839ab886cb4c05bd47a50845ad003d3ec5eba7e599a0b18fee704","external_calls":0},"operation":"web_reliability:cors_preflight_check"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_mZeZUAxtR5M_4kdNRZ3Jj","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates an HTTP method and request headers against a CORS preflight policy (allowed methods and allowed headers) and returns a deterministic pass/advisory finding.","exampleAgentPrompt":"Before I accept this cross-origin request, run a CORS preflight check: the method is DELETE, allowed methods are GET, POST, DELETE, request headers include Content-Type and Authorization, and allowed headers are Content-Type, Authorization, and X-Custom-Header.","exampleUseCases":[{"title":"API gateway preflight enforcement","prompt":"I need to validate a CORS preflight before my gateway accepts this request — the incoming method is POST, request headers are Content-Type and X-Api-Key, and my policy allows methods GET and POST with allowed headers Content-Type and Accept."},{"title":"Frontend CORS debugging","prompt":"My browser is sending an OPTIONS preflight with method PUT and headers Content-Type and X-Requested-With, but my server allows GET, POST with only Content-Type — can you run the CORS preflight check and tell me if it passes or fails?"},{"title":"Agent self-check before retrying a web call","prompt":"Before I retry this cross-origin request, check whether method PATCH with request headers Authorization and Content-Type is allowed given my policy allows methods GET, PATCH, DELETE and allowed headers Authorization, Content-Type, and Cache-Control."}],"resultDescription":"Returns versioned deterministic JSON containing normalized web evidence (the input values as received), the computed finding (which method or header failed or passed), and an explicit pass or advisory status indicating whether the request satisfies the CORS preflight policy.","failureModes":["Missing or empty method field results in an advisory or error finding","Malformed allowed_methods or allowed_headers arrays may cause a validation error","Request headers not present in allowed_headers list returns advisory/fail status","Method not present in allowed_methods list returns fail finding","Exceeding maxItems (256) on any array field may cause a request rejection","Payment failure via x402 protocol prevents the check from running"],"whenToPreferThis":"Choose this endpoint when you need a fast, stateless, deterministic CORS preflight validation without standing up your own policy engine. Ideal for AI agents that intercept or mediate cross-origin HTTP requests and need a bounded, auditable check — especially before accepting, caching, redirecting, or retrying a caller-supplied web response. Prefer this over manual string comparison when you need structured, versioned JSON evidence suitable for logging or downstream decision-making.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-19T12:44:40.088Z","isFirstParty":false,"canonicalSlug":"cors-preflight-check-86061418"}