# CORS Preflight Check

> CORS Preflight Check is a paid API for AI agents from api.delx.ai, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-15).

Validates an HTTP method and request headers against a CORS preflight policy (allowed methods and allowed headers) and returns a deterministic pass/advisory finding.

## Facts

- Endpoint: POST https://api.delx.ai/api/v1/x402/cors-preflight-check?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cors-preflight-check-86061418
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_nHbxk_lLx3MPlt22zsE39

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cors-preflight-check-86061418 -d '<json body>'
```

Example prompt: Before I accept this cross-origin request, run a CORS preflight check: the method is DELETE, allowed methods are GET, POST, DELETE, request headers include Content-Type and Authorization, and allowed headers are Content-Type, Authorization, and X-Custom-Header.

## When to prefer this

Choose this endpoint when you need a fast, stateless, deterministic CORS preflight validation without standing up your own policy engine. Ideal for AI agents that intercept or mediate cross-origin HTTP requests and need a bounded, auditable check — especially before accepting, caching, redirecting, or retrying a caller-supplied web response. Prefer this over manual string comparison when you need structured, versioned JSON evidence suitable for logging or downstream decision-making.

## Known failure modes

- Missing or empty method field results in an advisory or error finding
- Malformed allowed_methods or allowed_headers arrays may cause a validation error
- Request headers not present in allowed_headers list returns advisory/fail status
- Method not present in allowed_methods list returns fail finding
- Exceeding maxItems (256) on any array field may cause a request rejection
- Payment failure via x402 protocol prevents the check from running

## How this service works

CORS Preflight Check: CORS Preflight Check checks requested method and headers against a CORS preflight policy from bounded caller-supplied values without an external provider. Call CORS Preflight Check before accepting, caching, redirecting, or retrying a caller-supplied web response. Returns normalized web evidence, the computed finding, and an explicit pass or advisory status for CORS Preflight Check as versioned deterministic JSON. Price: $0.001 USDC via x402 on Base. First-party, stateless…

## Output

Returns versioned deterministic JSON containing normalized web evidence (the input values as received), the computed finding (which method or header failed or passed), and an explicit pass or advisory status indicating whether the request satisfies the CORS preflight policy.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "method": {
   "type": "string",
   "maxLength": 8192,
   "description": "Method supplied to CORS Preflight Check; used only for this bounded calculation and processed in memory without retention."
  },
  "allowed_headers": {
   "type": "array",
   "items": {
    "type": "string",
    "maxLength": 8192
   },
   "maxItems": 256,
   "description": "Allowed Headers supplied to CORS Preflight Check; used only for this bounded calculation and processed in memory without retention."
  },
  "allowed_methods": {
   "type": "array",
   "items": {
    "type": "string",
    "maxLength": 8192
   },
   "maxItems": 256,
   "description": "Allowed Methods supplied to CORS Preflight Check; used only for this bounded calculation and processed in memory without retention."
  },
  "request_headers": {
   "type": "array",
   "items": {
    "type": "string",
    "maxLength": 8192
   },
   "maxItems": 256,
   "description": "Request Headers supplied to CORS Preflight Check; used only for this bounded calculation and processed in memory without retention."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "result": {
   "allowed": true,
   "method_allowed": true,
   "missing_headers": []
  },
  "schema": "delx/util-cors-preflight-check/v1",
  "status": "pass",
  "evidence": {
   "retained": false,
   "input_sha256": "571002a70ff839ab886cb4c05bd47a50845ad003d3ec5eba7e599a0b18fee704",
   "external_calls": 0
  },
  "operation": "web_reliability:cors_preflight_check"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cors-preflight-check-86061418/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.delx.ai](https://www.zero.xyz/host/api.delx.ai/llms.txt)