# CORS Header Checker

> CORS Header Checker is a paid API for AI agents from cors-header-checker.underscoredone.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-12).

Sends a real HTTP request to a URL with a specified Origin header and returns all six standard CORS response headers plus a summary of whether cross-origin access is enabled and whether the tested origin is permitted.

## Facts

- Endpoint: POST https://cors-header-checker.underscoredone.com/check?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cors-header-checker-e29cf193
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_By4Ag0j-PZ0LigOeczxdN

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cors-header-checker-e29cf193 -d '<json body>'
```

Example prompt: Can you check whether https://api.stripe.com allows cross-origin requests from https://myapp.com — specifically whether that origin is permitted and whether credentialed requests are allowed?

## When to prefer this

Use this endpoint when you need to know the exact CORS headers a live server returns at runtime, rather than inferring from documentation. It is ideal for debugging browser CORS errors, post-deployment verification of CORS configuration, or auditing third-party APIs for cross-origin policy compliance. Prefer it over manual curl commands when you need the result programmatically with parsed fields like cors_enabled and origin_allowed.

## Known failure modes

- Target URL is unreachable or times out — error field contains the failure reason
- URL is malformed or missing http/https prefix — request rejected before being sent
- Target server returns no CORS headers — cors_enabled will be false and all header values null
- Network-level block prevents the probe from reaching the target — error populated
- Origin parameter is omitted — defaults to https://example.com which may not reflect real-world behavior

## How this service works

Sends a real request to any URL you provide, attaches an Origin header, and reads back all six standard cross-origin permission headers the server returns. Tells you whether cross-origin requests are enabled at all, whether your specific origin is permitted, and shows every permission value exactly as the server sent it. Useful for finding why a browser is blocking a request, confirming a new deployment is configured correctly, or auditing whether a public API allows credentialed calls.

## Output

A JSON object containing the target URL, HTTP status code of the probe request, a boolean cors_enabled flag, the tested origin string, an origin_allowed boolean, and the raw values of all six CORS headers (access-control-allow-origin, access-control-allow-methods, access-control-allow-headers, access-control-allow-credentials, access-control-expose-headers, access-control-max-age) exactly as the server returned them, plus any error message if the request failed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "description": "The full web address of the endpoint you want to check — must start with http:// or https://."
  },
  "origin": {
   "type": "string",
   "description": "The website address you want to test cross-origin access from, for example https://myapp.com. Defaults to https://example.com if you leave it out."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "url": "https://api.github.com",
  "error": "",
  "status": 200,
  "headers": {
   "access-control-max-age": null,
   "access-control-allow-origin": "https://github.com",
   "access-control-allow-headers": null,
   "access-control-allow-methods": null,
   "access-control-expose-headers": "ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset",
   "access-control-allow-credentials": null
  },
  "api_version": "1.0.0",
  "cors_enabled": true,
  "origin_tested": "https://myapp.com",
  "origin_allowed": false
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cors-header-checker-e29cf193/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from cors-header-checker.underscoredone.com](https://www.zero.xyz/host/cors-header-checker.underscoredone.com/llms.txt)