Create CORS Headers

Creates CORS headers for the website acceleration service. This operation is a full replacement: all existing CORS headers configured for the service will be removed and replaced with the provided values.

Request

Request-Line

POST /cdn/v1.0/services/{serviceId}/corsHeaders HTTP/1.1

Request Parameters

Path Parameters

Parameter	Type	Required	Description
serviceId	Integer	Mandatory	Service ID.

Body Parameters

Parameter	Type	Required	Description
accessControlAllowOrigin	String	Optional	Specifies which origins can access the response. Must be either *(allow all) or in the format schema://fqdn (e.g., https://www.example.com). null is not allowed.
accessControlExposeHeaders	String	Optional	Lists the headers that can be exposed to the browser when the requesting code runs in a CORS context. Accepts a comma-separated list of header names (e.g., "Content-Length, X-Request-Id").
accessControlMaxAge	Integer	Optional	Maximum time (in seconds) that a CORS preflight response can be cached. Accepts non-negative integers. 0 means no cache. Default is -1 (cache indefinitely).
accessControlAllowCredentials	Boolean	Optional	The server allows credentials to be included in cross-origin HTTP requests. true is the only valid value for this header and is case-sensitive. If you don't need credentials, omit this header entirely rather than setting its value to false.
accessControlAllowMethods	String	Optional	HTTP methods allowed for cross-origin requests. Accepts a single method or a comma-separated list. Supported values: GET, POST, PUT, DELETE, HEAD, OPTIONS, CONNECT, TRACE, PATCH.
accessControlAllowHeaders	String	Optional	HTTP headers that can be used during the actual request. Accepts a comma-separated list of header names (e.g., "Content-type, Authorization").

Response

Status Codes, Error Codes and Error Messages

Status Code	Error Code	Error Message
400	Request.BadRequest	Bad request.
400	InvalidCustomer.IdEmpty	Customer ID cannot be empty or invalid.
400	InvalidService.IdIncorrect	Service ID is empty or invalid.
400	InvalidService.IdPermission	Service ID cannot be found or unknown.
400	InvalidOrigin.UrlFormat	The origin must be in scheme://fqdn format.
400	InvalidPolicy.CorsHeaderForMethod	Invalid method. HTTP method must be one of the following values: GET, POST, PUT, DELETE, HEAD, OPTIONS, CONNECT, TRACE, or PATCH.
400	InvalidPolicy.CorsHeaderForCredentials	CORS Credential must be set to true.
400	InvalidPolicy.CorsHeaderForHeader	CORS Allow Header cannot be empty.
400	InvalidPolicy.CorsHeaderForMaxAge	CORS Max Age must be a non-negative integer.
400	InvalidPolicy.CorsHeaderForExposeHeader	CORS Expose Header cannot be empty.

Examples

Create CORS Headers

Request

POST /cdn/v1.0/services/228654/corsHeaders HTTP/1.1

{
    "accessControlAllowOrigin": "https://www.example.com",
    "accessControlExposeHeaders": "Content-Length, X-Request-Id",
    "accessControlMaxAge": 3600,
    "accessControlAllowCredentials": true,
    "accessControlAllowMethods": "GET,POST,OPTIONS",
    "accessControlAllowHeaders": "Content-Type, Authorization"
}

Successful Response Body

HTTP/1.1 200