openapi: 3.1.0
info:
  title: CORS Header Checker
  description: Sends a real request to any URL you provide, attaches an Origin header, and reads back all six standard cross-origin
    permission headers the server returns. Tells you whether cross-origin requests are enabled at all, whether your specific
    origin is permitted, and shows you every permission value exactly as the server sent it. Perfect for figuring out why
    a browser is blocking a request, confirming a freshly deployed service is configured correctly, or auditing whether a
    public API allows credentialed cross-origin calls.
  version: 1.0.0
  contact:
    name: _done
    url: https://forms.gle/5KzuSFH7p8hHtDmz7
    email: info@underscoredone.com
  x-openapi-url: https://cors-header-checker.underscoredone.com/openapi.json
  x-logo:
    url: https://underscoredone.com/logo.png
    altText: _done
  x-guidance: POST a JSON body with a required 'url' field (the endpoint to probe) and an optional 'origin' field (defaults
    to https://example.com). The response always includes 'cors_enabled' (boolean, true if any CORS header was found), 'origin_allowed'
    (boolean, true if the tested origin would be permitted by the browser), and a 'headers' object with all six Access-Control-*
    values as strings or null when absent. If the target server could not be reached, the response includes an 'error' string
    and 'status' is null — this is still a 200 response from this API, not an error. Only raise 400 for malformed input such
    as a non-HTTP URL. Use 'origin_allowed' to decide whether a frontend at that origin can call the URL. Use 'cors_enabled'
    to detect servers that return no CORS headers at all.
  x-ai-instructions: POST a JSON body with a required 'url' field (the endpoint to probe) and an optional 'origin' field (defaults
    to https://example.com). The response always includes 'cors_enabled' (boolean, true if any CORS header was found), 'origin_allowed'
    (boolean, true if the tested origin would be permitted by the browser), and a 'headers' object with all six Access-Control-*
    values as strings or null when absent. If the target server could not be reached, the response includes an 'error' string
    and 'status' is null — this is still a 200 response from this API, not an error. Only raise 400 for malformed input such
    as a non-HTTP URL. Use 'origin_allowed' to decide whether a frontend at that origin can call the URL. Use 'cors_enabled'
    to detect servers that return no CORS headers at all.
  x-provider: _done — single-purpose utility APIs for developers and AI agents. Pay per call with USDC on Base Mainnet or
    Solana Mainnet.
  x-pricing:
    model: pay-per-call
    currency: USDC
    network: Base Mainnet or Solana Mainnet
    price: $0.01
  x-keywords:
  - network
  - cors
  - header
  - checker
  - cross-origin
  - access-control
  - cors-debug
  - browser-blocked
  - preflight
  - origin-allowed
  - cors-audit
  - utility
  - api
  - ai-agent
  - pay-per-call
  - usdc
  - x402
  x-category: cors headers
  x-provider-url: https://underscoredone.com
  x-agentcash-auth:
    mode: paid
  x-402:
    price: $0.01
    network: eip155:8453
    asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913'
    pay_to: '0xE9740820225B3918b4ddd1292C7cA4Ca0e2C2F08'
    facilitator: https://api.cdp.coinbase.com/platform/v2/x402
    scheme: exact
    description: Sends a real request to any URL you provide, attaches an Origin header, and reads back all six standard cross-origin
      permission headers the server returns. Tells you whether cross-origin requests are enabled at all, whether your specific
      origin is permitted, and shows you every permission value exactly as the server sent it. Perfect for figuring out why
      a browser is blocking a request, confirming a freshly deployed service is configured correctly, or auditing whether
      a public API allows credentialed cross-origin calls.
    mime_type: application/json
    networks:
    - network: eip155:8453
      asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913'
      pay_to: '0xE9740820225B3918b4ddd1292C7cA4Ca0e2C2F08'
    - network: solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
      asset: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
      pay_to: 8ugAWAXDB8V18kiUrGZTq1oMvU3C6Fxs8hfC6rvzQT3b
paths:
  /check:
    post:
      tags:
      - cors headers
      - cors
      - cross origin
      - access-control-allow-origin
      - cors policy
      - cross origin resource sharing
      - is cors enabled
      - cors checker
      - cors misconfiguration
      - preflight check
      - browser cors error
      - allow-origin header
      - credentialed cors
      - cors audit
      - cors test
      summary: Check which cross-origin permissions a URL grants for a given origin
      description: Send a real HTTP request to any web address with an Origin header attached, and report back every cross-origin
        permission header the server returns.
      operationId: handler_check_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CheckRequest'
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CheckResponse'
              examples:
                success:
                  summary: Successful response
                  value:
                    api_version: 1.0.0
                    url: https://api.github.com
                    origin_tested: https://myapp.com
                    status: 200
                    cors_enabled: true
                    origin_allowed: false
                    headers:
                      access-control-allow-origin: https://github.com
                      access-control-allow-methods: null
                      access-control-allow-headers: null
                      access-control-allow-credentials: null
                      access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining,
                        X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes,
                        X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
                      access-control-max-age: null
                    error: null
        '422':
          description: Unprocessable — a required field is missing or the wrong type. Check the detail field for specifics.
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: array
        '402':
          description: Payment required. Send a signed USDC payment on Base Mainnet or Solana Mainnet using the x402 protocol.
          headers:
            X-Payment-Response:
              description: x402 payment challenge — base64-encoded JSON with payment details.
              schema:
                type: string
        '400':
          description: Bad request — your input failed validation or could not be processed. Check the detail field for specifics.
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
      x-ai-instructions: POST a JSON body with a required 'url' field (the endpoint to probe) and an optional 'origin' field
        (defaults to https://example.com). The response always includes 'cors_enabled' (boolean, true if any CORS header was
        found), 'origin_allowed' (boolean, true if the tested origin would be permitted by the browser), and a 'headers' object
        with all six Access-Control-* values as strings or null when absent. If the target server could not be reached, the
        response includes an 'error' string and 'status' is null — this is still a 200 response from this API, not an error.
        Only raise 400 for malformed input such as a non-HTTP URL. Use 'origin_allowed' to decide whether a frontend at that
        origin can call the URL. Use 'cors_enabled' to detect servers that return no CORS headers at all.
      x-guidance: POST a JSON body with a required 'url' field (the endpoint to probe) and an optional 'origin' field (defaults
        to https://example.com). The response always includes 'cors_enabled' (boolean, true if any CORS header was found),
        'origin_allowed' (boolean, true if the tested origin would be permitted by the browser), and a 'headers' object with
        all six Access-Control-* values as strings or null when absent. If the target server could not be reached, the response
        includes an 'error' string and 'status' is null — this is still a 200 response from this API, not an error. Only raise
        400 for malformed input such as a non-HTTP URL. Use 'origin_allowed' to decide whether a frontend at that origin can
        call the URL. Use 'cors_enabled' to detect servers that return no CORS headers at all.
      x-payment-info:
        price:
          fixed:
            mode: fixed
            currency: USD
            amount: '0.01'
        protocols:
        - x402: {}
components:
  schemas:
    CheckRequest:
      properties:
        url:
          type: string
          title: Url
          description: The full web address of the endpoint you want to check — must start with http:// or https://.
        origin:
          anyOf:
          - type: string
          - type: 'null'
          title: Origin
          description: The website address you want to test cross-origin access from, for example https://myapp.com. Defaults
            to https://example.com if you leave it out.
          default: https://example.com
      type: object
      required:
      - url
      title: CheckRequest
      example:
        origin: https://myapp.com
        url: https://api.github.com
    CheckResponse:
      properties:
        api_version:
          type: string
          title: Api Version
          description: API version
          default: 1.0.0
        url:
          type: string
          title: Url
          description: The web address that was checked.
        origin_tested:
          type: string
          title: Origin Tested
          description: The origin address that was used in the check.
        status:
          anyOf:
          - type: integer
          - type: 'null'
          title: Status
          description: The HTTP status code the server responded with, or null if the server could not be reached.
        cors_enabled:
          type: boolean
          title: Cors Enabled
          description: True if the server sent at least one cross-origin permission header back.
        origin_allowed:
          type: boolean
          title: Origin Allowed
          description: True if a browser would allow your origin to make requests to this URL based on the server's response.
        headers:
          additionalProperties: true
          type: object
          title: Headers
          description: All six standard cross-origin permission headers as returned by the server. Each value is the exact
            text the server sent, or null if the server did not include that header.
        error:
          anyOf:
          - type: string
          - type: 'null'
          title: Error
          description: A plain-English description of what went wrong if the server could not be reached, or null if everything
            worked fine.
      type: object
      required:
      - url
      - origin_tested
      - cors_enabled
      - origin_allowed
      - headers
      title: CheckResponse
      example:
        api_version: 1.0.0
        cors_enabled: true
        headers:
          access-control-allow-origin: https://github.com
          access-control-expose-headers: ETag, Link, Location
        origin_allowed: false
        origin_tested: https://myapp.com
        status: 200
        url: https://api.github.com
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
  securitySchemes:
    siwx:
      type: apiKey
      in: header
      name: SIGN-IN-WITH-X
      description: CAIP-122 wallet signature for repeat access after payment
servers:
- url: https://cors-header-checker.underscoredone.com
  description: Production
tags:
- name: cors headers
- name: cors
- name: cross origin
- name: access-control-allow-origin
- name: cors policy
- name: cross origin resource sharing
- name: is cors enabled
- name: cors checker
- name: cors misconfiguration
- name: preflight check
- name: browser cors error
- name: allow-origin header
- name: credentialed cors
- name: cors audit
- name: cors test
x402Version: 2
x-payment-accepts:
- scheme: exact
  network: eip155:8453
  payTo: '0xE9740820225B3918b4ddd1292C7cA4Ca0e2C2F08'
  asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913'
- scheme: exact
  network: solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
  payTo: 8ugAWAXDB8V18kiUrGZTq1oMvU3C6Fxs8hfC6rvzQT3b
  asset: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v