> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endstate.io/llms.txt
> Use this file to discover all available pages before exploring further.

# endstate.settings.corsOrigins.list

> Returns the origins allowed to call the API from a browser. Requests made with browser credentials from any other origin are rejected.

```ts theme={null}
    list(options?: RequestOptions): Promise<CorsOriginsResponse>
```

|             |                                                                              |
| ----------- | ---------------------------------------------------------------------------- |
| Endpoint    | [`GET /v1/settings/cors-origins`](/api-reference/settings/list-cors-origins) |
| Credential  | Secret key (`end_sk_...`)                                                    |
| Retry class | `read`                                                                       |

Retried on network failure, timeout, `429`, and `5xx`.

## Example

```ts theme={null}
const result = await endstate.settings.corsOrigins.list();
```

## Returns

`200` - `CorsOriginsResponse`.

<ResponseField name="cors_origins" type="string[]" required>
  Origins allowed to call the API from a browser, in canonical form.
</ResponseField>

## Errors

Branch on `error.code`, never on the HTTP status - several codes share one.

| Code                | HTTP | Retry         |
| ------------------- | ---- | ------------- |
| `auth.unauthorized` | 401  | Do not retry  |
| `internal.error`    | 500  | Safe to retry |

See [Errors and retries](/sdks/core/errors-and-retries) for the error types and how to narrow them.