{
"url": "https://api.github.com/",
"origin": "https://myapp.com",
"originIsDefault": false,
"simpleRequest": {
"statusCode": 403,
"headers": {
"access-control-allow-origin": "*",
"access-control-expose-headers": "ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-RateLimit-Used, X-RateLimit-Resource, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, Deprecation, Sunset"
}
},
"preflight": {
"statusCode": 204,
"headers": {
"access-control-allow-origin": "*",
"access-control-allow-methods": "GET, POST, PATCH, PUT, DELETE",
"access-control-allow-headers": "Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Accept-Encoding, X-GitHub-OTP, X-Requested-With, User-Agent, GraphQL-Features, X-Github-Next-Global-ID, X-GitHub-Api-Version, X-Fetch-Nonce, Copilot-Integration-Id, DD-CLIENT-TOKEN, X-Client-Application, X-Experiment-Commit-Agent-Version, Idempotency-Key",
"access-control-expose-headers": "ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, X-GitHub-Edge-Region, Deprecation, Sunset",
"access-control-max-age": "86400",
"vary": "Accept-Encoding, Accept, X-Requested-With"
}
},
"issues": [],
"cached": true
}
curl --location --request GET 'https://zylalabs.com/api/14063/cors+policy+checker+api/34492/check+url+cors+policy?url=https://api.github.com&origin=https://myapp.com' --header 'Authorization: Bearer YOUR_API_KEY'
After signing up, every developer is assigned a personal API access key, a unique combination of letters and digits provided to access to our API endpoint. To authenticate with the CORS Policy Checker API simply include your bearer token in the Authorization header.
| Header | Description |
|---|---|
Authorization
|
Required
Should be Bearer access_key. See "Your API Access Key" above when you are subscribed.
|
No long-term commitment. Upgrade, downgrade, or cancel anytime. Free Trial includes up to 50 requests.
Give it a URL (and optionally the Origin to check) and it checks that server's CORS response headers (Access-Control-Allow-Origin, -Methods, -Headers, -Credentials, -Max-Age) using both a simple request and a preflight (OPTIONS) request, then returns structured JSON. Common CORS misconfigurations are flagged automatically in an issues array: a wildcard origin combined with Credentials true (invalid per the spec), missing Access-Control headers that make browser cross-origin calls fail, and a requested Origin that is not in the allowed list. Useful for API integration debugging, automated pre-deploy checks (CI), and checking whether a third-party API can be called from a browser. CORS is defined by the WHATWG Fetch Standard. If no Origin is given, a neutral probe (https://example.com) is used. The verdict accounts for servers that attach CORS headers to only one of the simple request or preflight responses, but because servers may respond differently per request method and headers, it does not cover every possible combination. Results are cached for 6 hours.
The Check URL CORS Policy endpoint returns structured JSON data that includes the CORS response headers from both simple and preflight requests, along with a verdict on whether the origin is allowed and any identified misconfiguration issues.
Key fields in the response include "url" (the checked URL), "origin" (the origin being checked), "simpleRequest" and "preflight" (each containing status codes and headers), and "issues" (an array of identified CORS misconfigurations).
The response data is organized into a JSON object with top-level fields for the URL, origin, and two nested objects for simple and preflight requests, each containing status codes and headers, plus an issues array for misconfigurations.
The endpoint provides information on CORS response headers, including Access-Control-Allow-Origin, -Methods, -Headers, -Credentials, and -Max-Age, as well as any misconfiguration issues detected during the checks.
The primary parameter is the URL to check, and an optional "Origin" parameter can be provided to specify the origin being tested. If no origin is given, a default neutral probe is used.
Users can analyze the returned CORS headers to ensure their applications can make cross-origin requests successfully. The issues array helps identify and resolve common misconfigurations, improving API integration and deployment readiness.
Typical use cases include debugging API integrations, performing automated checks during CI/CD processes, and verifying if third-party APIs can be accessed from a browser, ensuring compliance with CORS policies.
Data accuracy is maintained by checking both simple and preflight requests, allowing the API to detect inconsistencies in CORS headers. Additionally, results are cached for 6 hours to ensure timely yet reliable information.
To obtain your API key, first sign in to your account and navigate to the API you want to use. From the API's Pricing section, choose a plan and complete the subscription process. Once subscribed, return to the API page and you will see your API Access Key displayed at the top of the documentation page. You can use this key to authenticate your requests.
You can’t switch APIs during the free trial. If you subscribe to a different API, your trial will end and the new subscription will start as a paid plan.
The free trial lasts for 7 days and allows you to make up to 50 API requests.
No, the free trial is available only once, so we recommend using it on the API that interests you the most. Most of our APIs offer a free trial, but some may not include this option.
Yes. If the API offers a free trial, you will see a "Free 7-Day Trial" option in its Pricing section. The trial lasts for 7 days and allows up to 50 API requests, enabling you to evaluate the API before subscribing to a paid plan.
Zyla API Hub is like a big store for APIs, where you can find thousands of them all in one place. We also offer dedicated support and real-time monitoring of all APIs. Once you sign up, you can pick and choose which APIs you want to use. Just remember, each API needs its own subscription. But if you subscribe to multiple ones, you'll use the same key for all of them, making things easier for you.
You can monitor your API usage through the response headers included with every request:
x-zyla-api-calls-monthly-used: Shows the total number of API requests you have used during the current billing period.
x-zyla-api-calls-monthly-remaining: Shows the number of API requests you have remaining for the current billing period.
Yes, you can cancel your subscription at any time. Simply go to the Pricing section of the API you're subscribed to and click the "Unsubscribe" button.
Please note that upgrades, downgrades, and cancellations take effect immediately. Once your subscription is canceled, access to the service will end immediately, regardless of any remaining API calls in your quota.
Please have a look at our Refund Policy: https://zylalabs.com/terms#refund