# Forest Web CORS Preflight Inspector

> Forest Web CORS Preflight Inspector is a paid API for AI agents from http--forest-gas-station-mainnet--lcjl27p8lmjs.code.run, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-20).

Sends a single CORS OPTIONS preflight request to a public URL and normalizes the Access-Control-Allow-* response into structured origin, method, and header permission decisions.

## Facts

- Endpoint: POST https://http--forest-gas-station-mainnet--lcjl27p8lmjs.code.run/cors/preflight?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/forest-web-cors-preflight-inspector-d890a728
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Jd8vTm13I4cmk_EIfraJ2

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability forest-web-cors-preflight-inspector-d890a728 -d '<json body>'
```

Example prompt: Can you check whether https://api.example.com/data allows CORS preflight requests from https://myapp.com using GET and the Authorization header?

## When to prefer this

Choose this endpoint when you need a lightweight, non-invasive check of a URL's CORS policy before attempting a browser-side cross-origin fetch. It is ideal for pre-integration audits, debugging CORS errors, or validating that a third-party API will accept requests from a specific origin with particular methods and headers. It is not suitable when you need to follow redirects, test credentialed (cookie/Authorization) requests, verify actual resource responses, or execute JavaScript-dependent behavior.

## Known failure modes

- Target URL is unreachable or returns a network error — no CORS data returned
- Server does not respond to OPTIONS requests — may indicate CORS is not supported
- Redirect encountered — Forest does not follow redirects, so the CORS state of the final destination is not reported
- Malformed or missing Access-Control-Allow-* headers — normalized result may show denial or undefined policy
- URL does not match required http/https pattern — request rejected with validation error
- Requested headers list exceeds 20 items — input rejected

## How this service works

Machine-readable contract for active Forest paid capabilities. Unsigned paid calls return HTTP 402 with a PAYMENT-REQUIRED x402 challenge.

## Output

Returns a normalized breakdown of the CORS preflight response: whether the target URL allows the specified origin, which HTTP methods are permitted, which request headers are allowed, and the raw Access-Control-Allow-* header values observed. The result reflects only what the server declared in the OPTIONS response at the exact URL — no redirects are followed and no cookies or credentials are sent.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "pattern": "^https?://",
   "maxLength": 2048,
   "minLength": 1,
   "description": "Public HTTP(S) URL to inspect, resolve, or compare."
  },
  "origin": {
   "type": "string",
   "pattern": "^https?://",
   "maxLength": 2048,
   "minLength": 1,
   "description": "Public origin value used to scope this lookup."
  },
  "requested_method": {
   "type": "string",
   "maxLength": 32,
   "minLength": 1,
   "description": "Public requested method value used to scope this lookup."
  },
  "requested_headers": {
   "type": "array",
   "items": {
    "type": "string",
    "maxLength": 128,
    "minLength": 1
   },
   "maxItems": 20,
   "description": "Public requested headers value used to scope this lookup."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "data": {
   "scope": "observed_noncredentialed_cors_preflight_only",
   "status": 100,
   "blockers": [],
   "warnings": [],
   "final_url": "example",
   "allowed_origin": "example",
   "method_allowed": false,
   "origin_allowed": false,
   "redirect_count": 0,
   "allowed_headers": [],
   "allowed_methods": [],
   "headers_allowed": false,
   "preflight_passes": false,
   "credentials_allowed": false,
   "provider_request_count": 1
  },
  "meta": {
   "cache": "miss",
   "provider": "safe-http-options",
   "checked_at": "2026-01-01T00:00:00.000Z",
   "duration_ms": 0
  },
  "version": "1",
  "capability": "cors.preflight"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/forest-web-cors-preflight-inspector-d890a728/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from http--forest-gas-station-mainnet--lcjl27p8lmjs.code.run](https://www.zero.xyz/host/http--forest-gas-station-mainnet--lcjl27p8lmjs.code.run/llms.txt)