# CORS Origin Check

> CORS Origin Check is a paid API for AI agents from api.delx.ai, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-15).

Validates whether a request origin is in an explicit list of allowed origins and returns a deterministic pass/advisory finding for CORS policy enforcement.

## Facts

- Endpoint: POST https://api.delx.ai/api/v1/x402/cors-origin-check
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cors-origin-check-f25b4a7d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap__uHAq_6_vTQncAyBTT3GA

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cors-origin-check-f25b4a7d -d '<json body>'
```

Example prompt: Check whether the origin 'https://app.example.com' is allowed by CORS policy given the allowed list ['https://app.example.com', 'https://admin.example.com'] with credentials enabled, and tell me if it passes.

## When to prefer this

Choose this endpoint when you need a stateless, deterministic, auditable CORS origin check without any external dependencies or API keys — particularly useful in agent pipelines that must gate on CORS compliance before accepting, caching, redirecting, or retrying a caller-supplied web response. Prefer it over custom code when you need versioned, reproducible JSON evidence of the CORS decision for logging or compliance purposes.

## Known failure modes

- Origin or allowed list missing from request body — returns validation error
- Allowed list exceeds 256 items — rejected by schema constraint
- Wildcard origin patterns may not be evaluated as regex — only exact string matching
- Malformed origin URL may result in normalization advisory rather than hard pass
- Non-boolean credentials field — schema type error

## How this service works

CORS Origin Check: CORS Origin Check compares a request origin with explicit allowed origins from bounded caller-supplied values without an external provider. Call CORS Origin Check before accepting, caching, redirecting, or retrying a caller-supplied web response. Returns normalized web evidence, the computed finding, and an explicit pass or advisory status for CORS Origin Check as versioned deterministic JSON. Price: $0.001 USDC via x402 on Base. First-party, stateless, memory-only execution…

## Output

Returns versioned deterministic JSON containing: normalized web evidence of the origin and allowed-list inputs, the computed CORS finding (whether the origin matches any allowed entry, and credentials compatibility), and an explicit pass or advisory status indicating whether the request origin should be accepted.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "origin": {
   "type": "string",
   "maxLength": 8192,
   "description": "Origin supplied to CORS Origin Check; used only for this bounded calculation and processed in memory without retention."
  },
  "allowed": {
   "type": "array",
   "items": {
    "type": "string",
    "maxLength": 8192
   },
   "maxItems": 256,
   "description": "Allowed supplied to CORS Origin Check; used only for this bounded calculation and processed in memory without retention."
  },
  "credentials": {
   "type": "boolean",
   "description": "Credentials supplied to CORS Origin Check; used only for this bounded calculation and processed in memory without retention."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "result": {
   "origin": "https://app.example.com/",
   "allowed": true,
   "credentials": true
  },
  "schema": "delx/util-cors-origin-check/v1",
  "status": "pass",
  "evidence": {
   "retained": false,
   "input_sha256": "502a62c83d87812324c4b1fe1a2a0df77db850e0a6e49fef68313499e8d02d82",
   "external_calls": 0
  },
  "operation": "web_reliability:cors_origin_check"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cors-origin-check-f25b4a7d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.delx.ai](https://www.zero.xyz/host/api.delx.ai/llms.txt)