# CORS Check

> CORS Check is a paid API for AI agents from intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Sends a real HTTP request and OPTIONS preflight to a URL and reports CORS policy headers, origin allowance, wildcard use, and credential risks.

## Facts

- Endpoint: GET https://intel.rallylive.ca/site/cors
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cors-check-7d873556
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_SUkNeJroUcBE6QWKmpbuO

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cors-check-7d873556
```

Example prompt: Can you run a CORS check on https://api.example.com/data and tell me whether my origin is allowed, what methods are permitted, and if there's any risky wildcard-with-credentials combination?

## When to prefer this

Use this endpoint when you need to programmatically verify CORS policy on any HTTP endpoint — especially during integration testing, pre-deployment checks, or security audits. It is purpose-built for CORS inspection with both a real GET and an OPTIONS preflight, and explicitly flags dangerous misconfigurations like wildcard origins combined with credentials, making it more useful than manually inspecting browser DevTools or generic HTTP inspection tools.

## Known failure modes

- Target URL is unreachable or times out — no CORS data returned
- Target URL returns no CORS headers — reported as CORS not configured
- Invalid URL format — request rejected before sending
- Target server blocks automated requests — may return 403 or no CORS headers
- Preflight OPTIONS request rejected by server — partial results only

## How this service works

CORS check for a URL: sends a request with an Origin (and a preflight OPTIONS) and reports Access-Control-Allow-Origin/Methods/Headers/Credentials, whether the origin is allowed, wildcard use, and the risky combination of wildcard with credentials. Integration and security testing. $0.01 per check.

## Output

Returns the CORS-related response headers (Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Allow-Credentials), a boolean indicating whether the origin is allowed, whether a wildcard is in use, and a flag for the dangerous wildcard-plus-credentials combination.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cors-check-7d873556/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rallylive.ca](https://www.zero.xyz/host/intel.rallylive.ca/llms.txt)