# Lordevo CORS Check

> Lordevo CORS Check is a paid API for AI agents from shop.lordevo.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-31).

Tests whether a browser on a given origin can call a target URL by sending a CORS preflight (OPTIONS) and GET request, then reporting CORS headers, security flags, and permission verdicts.

## Facts

- Endpoint: GET https://shop.lordevo.com/api/quick/cors-check?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/lordevo-cors-check-500323a8
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_9s01geK-25gbU841jbTx6

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability lordevo-cors-check-500323a8
```

Example prompt: Can you check if my frontend at https://app.mycompany.com is allowed to make GET requests to https://api.thirdparty.com/data — specifically run the CORS preflight and tell me if the origin is allowed, whether credentials are permitted, and flag any security issues like arbitrary-origin reflection?

## When to prefer this

Use this endpoint when you need a live, real-time CORS preflight test for a specific URL and origin combination — especially when debugging browser fetch failures, auditing third-party APIs for CORS misconfigurations, or checking for dangerous security patterns like arbitrary-origin reflection or wildcard credentials. Prefer this over manual browser DevTools inspection when automating security checks in pipelines or agent workflows.

## Known failure modes

- Target URL is unreachable or returns a non-HTTP error — endpoint may return a network error or timeout
- Invalid URL format — returns a validation error
- Target server does not respond to OPTIONS preflight — preflight_status may be null or unexpected
- No CORS headers returned — `allowed` is false and `allow_origin` is null
- Rate-limit or 402 payment required if the x402 payment is not processed correctly

## How this service works

SEO audits, website security checks, SEO content plans, articles and site fix plans as API endpoints for AI agents. Pay per request in USDC on Base with…

## Output

A JSON object containing: the target URL and tested origin, an `allowed` boolean indicating whether the browser would be permitted, the raw `Access-Control-Allow-Origin` value, `allow_credentials` boolean, `allow_methods` string, `preflight_status` code, `vary_origin` boolean, `reflects_arbitrary_origin` flag, and an `issues` array listing detected CORS security problems.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "description": "Public http(s) URL or bare domain, e.g. https://example.com"
      },
      "method": {
       "enum": [
        "GET",
        "POST",
        "PUT",
        "PATCH",
        "DELETE"
       ],
       "type": "string",
       "default": "GET",
       "description": "Method for the preflight"
      },
      "origin": {
       "type": "string",
       "default": "https://example.com",
       "pattern": "^https?://[a-zA-Z0-9.-]+(:\\d{1,5})?$",
       "description": "Origin to test, e.g. https://app.example.com"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "required": [
      "tool",
      "url",
      "allowed"
     ],
     "properties": {
      "url": {
       "type": "string"
      },
      "tool": {
       "type": "string"
      },
      "issues": {
       "type": "array"
      },
      "origin": {
       "type": "string"
      },
      "allowed": {
       "type": "boolean"
      },
      "allow_origin": {
       "type": [
        "string",
        "null"
       ]
      },
      "allow_credentials": {
       "type": "boolean"
      },
      "reflects_arbitrary_origin": {
       "type": [
        "boolean",
        "null"
       ]
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "url": "https://api.example.com/v1/items",
  "tool": "cors-check",
  "issues": [],
  "method": "GET",
  "origin": "https://app.example.com",
  "allowed": true,
  "vary_origin": true,
  "allow_origin": "https://app.example.com",
  "allow_methods": "GET, POST",
  "preflight_status": 204,
  "allow_credentials": true,
  "reflects_arbitrary_origin": false
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lordevo-cors-check-500323a8/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from shop.lordevo.com](https://www.zero.xyz/host/shop.lordevo.com/llms.txt)