# WebSchutz CORS Policy Decision

> WebSchutz CORS Policy Decision is a paid API for AI agents from webschutz.halowerk.com, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-22).

Passively fetches and evaluates the CORS policy of a public URL to determine whether an accidental wildcard or misconfigured CORS header is present, returning a structured verdict with evidence and recommendations.

## Facts

- Endpoint: POST https://webschutz.halowerk.com/v1/cors-policy-decision?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-22
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/webschutz-cors-policy-decision-ced43db8
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_94Kkd5qJUVvX7zMBsxYn3

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability webschutz-cors-policy-decision-ced43db8 -d '<json body>'
```

Example prompt: Can you passively check whether https://api.example.com has an accidental wildcard CORS misconfiguration and give me the verdict, the actual evidence from the headers, and what I should do about it?

## When to prefer this

Choose this endpoint when you need a passive, non-intrusive, evidence-based evaluation of a specific URL's CORS policy — especially when you want a structured verdict (pass/fail/warning) with traceable evidence rather than a raw header dump. Prefer this over generic HTTP header inspection tools when the specific concern is wildcard CORS misconfiguration and you need actionable remediation guidance baked into the response.

## Known failure modes

- Target URL is unreachable or returns a non-public response — endpoint cannot retrieve evidence
- Target domain does not respond with any CORS headers — observation will note absence
- Invalid or malformed URL input — returns validation error
- Target server blocks automated header inspection — evidence may be incomplete
- Rate limiting or network timeouts on the target side — may result in inconclusive verdict

## How this service works

No accidental wildcard CORS decision fetches current public evidence from the supplied target and evaluates the documented criterion. It returns the observation, threshold, verdict, exact evidence source, limitations and a mode-specific action. The check is passive: no login attempt, payload injection, exploit, purchase, form submission or load test is performed.

## Output

Returns a structured JSON object containing: the observed CORS header value, the evaluated threshold criterion, a pass/fail/warning verdict, the exact evidence source (e.g. response header from the target), any limitations of the passive check, and a mode-specific recommended action. No credentials, exploits, or form submissions are made during inspection.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "target": {
   "type": "string",
   "maxLength": 2048,
   "minLength": 3,
   "description": "Public HTTP(S) URL or domain to inspect. A bare domain is normalized to HTTPS."
  },
  "context": {
   "type": "object",
   "description": "Optional non-secret correlation labels returned unchanged only in the request lifecycle.",
   "maxProperties": 12,
   "additionalProperties": {
    "type": [
     "string",
     "number",
     "boolean",
     "null"
    ]
   }
  },
  "baseline": {
   "type": [
    "object",
    "null"
   ],
   "description": "Optional baseline returned by a previous snapshot call.",
   "additionalProperties": true
  },
  "compare_url": {
   "type": "string",
   "maxLength": 2048,
   "minLength": 3,
   "description": "Optional public comparison URL. Used by change and monitoring services."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/webschutz-cors-policy-decision-ced43db8/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from webschutz.halowerk.com](https://www.zero.xyz/host/webschutz.halowerk.com/llms.txt)