> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endstate.io/llms.txt
> Use this file to discover all available pages before exploring further.

# endstate.settings.corsOrigins.replace

> Replaces the full list of origins allowed to call the API from a browser. Each entry is an exact origin, a subdomain wildcard like `https://*.brand.example`, or a port wildcard like `http://localhost:*`; entries are stored in canonical form and returned as saved. Send an empty array to remove all origins. Changes take effect within about a minute. Every origin on this list can call the API from a browser, so remove development origins such as `http://localhost:*` before you go live.

```ts theme={null}
    replace(body: UpdateCorsOriginsRequest, options?: RequestOptions): Promise<CorsOriginsResponse>
```

|             |                                                                                 |
| ----------- | ------------------------------------------------------------------------------- |
| Endpoint    | [`PUT /v1/settings/cors-origins`](/api-reference/settings/replace-cors-origins) |
| Credential  | Secret key (`end_sk_...`)                                                       |
| Retry class | `write`                                                                         |

Never repeated. The API accepts no idempotency key here, so a second send is a second write. Only `429 rate_limit.exceeded` is retried.

## Example

```ts theme={null}
const result = await endstate.settings.corsOrigins.replace({
  cors_origins: [],
});
```

## Parameters

<ParamField body="cors_origins" type="string[]" required>
  The complete allow-list. Replaces the previous list; send an empty array to remove all origins.
</ParamField>

## Returns

`200` - `CorsOriginsResponse`.

<ResponseField name="cors_origins" type="string[]" required>
  Origins allowed to call the API from a browser, in canonical form.
</ResponseField>

## Errors

Branch on `error.code`, never on the HTTP status - several codes share one.

| Code                | HTTP | Retry         |
| ------------------- | ---- | ------------- |
| `auth.unauthorized` | 401  | Do not retry  |
| `internal.error`    | 500  | Safe to retry |
| `validation.failed` | 400  | Do not retry  |

See [Errors and retries](/sdks/core/errors-and-retries) for the error types and how to narrow them.