CORS origins

endstate.settings.corsOrigins.replace

Replaces the full list of origins allowed to call the API from a browser. Each entry is an exact origin, a subdomain wildcard like https://*.brand.example, or a port wildcard like http://localhost:*; entries are stored in canonical form and returned as saved. Send an empty array to remove all origins. Changes take effect within about a minute. Every origin on this list can call the API from a browser, so remove development origins such as http://localhost:* before you go live.

    replace(body: UpdateCorsOriginsRequest, options?: RequestOptions): Promise<CorsOriginsResponse>


Endpoint	`PUT /v1/settings/cors-origins`
Credential	Secret key (`end_sk_...`)
Retry class	`write`

Never repeated. The API accepts no idempotency key here, so a second send is a second write. Only 429 rate_limit.exceeded is retried.

Example

const result = await endstate.settings.corsOrigins.replace({
  cors_origins: [],
});

Parameters

string[]

required

The complete allow-list. Replaces the previous list; send an empty array to remove all origins.

Returns

200 - CorsOriginsResponse.

string[]

required

Origins allowed to call the API from a browser, in canonical form.

Errors

Branch on error.code, never on the HTTP status - several codes share one.

Code	HTTP	Retry
`auth.unauthorized`	401	Do not retry
`internal.error`	500	Safe to retry
`validation.failed`	400	Do not retry

See Errors and retries for the error types and how to narrow them.

Get started

Core SDK

Reader SDK

endstate.settings.corsOrigins.replace

Example

Parameters

Returns

Errors

​Example

​Parameters

​Returns

​Errors

Example

Parameters

Returns

Errors