{"id":"cors-preflight","title":"CORS preflight decision from Fetch spec","description":"Takes a browser request shape (origin, method, headers, credentials flag) and a server CORS policy (allow-origin, allow-methods, allow-headers, allow-credentials, expose-headers, max-age) and returns the exact decision a browser would make per the Fetch Living Standard §3.2 and §4.10: whether a preflight OPTIONS is required, whether the main request is allowed, which response headers the script can read, and which rule killed it when it is denied. No network — the policy is an input, not fetched. Catches the three bugs every stack reinvents: Access-Control-Allow-Origin: '*' with credentials, wildcard allow-headers with credentials, and forbidden request headers like Cookie that the spec blocks before the policy is consulted.","roi":"A CORS failure costs an engineering half-day across backend and frontend; this returns the offending rule in one call without browser-side guesswork.","audience":"developer","package":"infra-preflight-kit","channels":["x402","mcp"],"endpoint":{"method":"POST","url":"https://agents.writerslogic.com/api/v1/cors-preflight","path":"/api/v1/cors-preflight","contentType":"application/json"},"price":{"amount":"0.005","currency":"USDC","network":"base","perCall":true,"failedCallsCharged":false},"inputSchema":{"type":"object","additionalProperties":false,"required":["request","policy"],"properties":{"request":{"type":"object","required":["origin","method"],"properties":{"origin":{"type":"string","maxLength":200,"description":"The ASCII serialization of the request's origin, e.g. 'https://app.example.com'. 'null' for opaque origins."},"method":{"type":"string","maxLength":20,"description":"HTTP method of the main request (not the preflight), e.g. 'POST'."},"url":{"type":"string","maxLength":2000,"description":"Target URL, optional. Not used in the Fetch decision; carried through for logging."},"headers":{"type":"object","description":"Request headers the main request will send. Names are case-insensitive."},"withCredentials":{"type":"boolean","description":"True if the request uses credentials mode 'include'."}}},"policy":{"type":"object","properties":{"allowOrigin":{"anyOf":[{"type":"string","maxLength":200},{"type":"array","items":{"type":"string","maxLength":200},"maxItems":100}],"description":"The Access-Control-Allow-Origin value, as a string ('*' or an origin) or an array of permitted origins the server echoes from."},"allowMethods":{"type":"array","items":{"type":"string","maxLength":20},"maxItems":20,"description":"Access-Control-Allow-Methods. '*' is accepted (ignored with credentials)."},"allowHeaders":{"type":"array","items":{"type":"string","maxLength":100},"maxItems":100,"description":"Access-Control-Allow-Headers (case-insensitive). '*' is accepted (ignored with credentials)."},"allowCredentials":{"type":"boolean","description":"Access-Control-Allow-Credentials: true."},"exposeHeaders":{"type":"array","items":{"type":"string","maxLength":100},"maxItems":100,"description":"Access-Control-Expose-Headers."},"maxAge":{"type":"integer","description":"Access-Control-Max-Age in seconds."}}}}},"resultSchema":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"allowed":{"type":"boolean","description":"Whether the main request (after any preflight) would succeed."},"preflightRequired":{"type":"boolean","description":"Whether the browser would first send OPTIONS."},"preflightResponse":{"type":"object","description":"The headers the server must return on the OPTIONS preflight for this request to be approved."},"exposedResponseHeaders":{"type":"array","items":{"type":"string"},"description":"Response headers that would be visible to the script (CORS-safelisted plus Access-Control-Expose-Headers)."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"outputSchema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"allowed":{"type":"boolean","description":"Whether the main request (after any preflight) would succeed."},"preflightRequired":{"type":"boolean","description":"Whether the browser would first send OPTIONS."},"preflightResponse":{"type":"object","description":"The headers the server must return on the OPTIONS preflight for this request to be approved."},"exposedResponseHeaders":{"type":"array","items":{"type":"string"},"description":"Response headers that would be visible to the script (CORS-safelisted plus Access-Control-Expose-Headers)."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]},"example":{"request":{"origin":"https://app.example.com","method":"POST","headers":{"content-type":"application/json","authorization":"Bearer x"},"withCredentials":true},"policy":{"allowOrigin":["https://app.example.com"],"allowMethods":["POST"],"allowHeaders":["authorization","content-type"],"allowCredentials":true,"maxAge":600}},"openapiOperation":{"operationId":"cors_preflight","summary":"CORS preflight decision from Fetch spec","description":"Takes a browser request shape (origin, method, headers, credentials flag) and a server CORS policy (allow-origin, allow-methods, allow-headers, allow-credentials, expose-headers, max-age) and returns the exact decision a browser would make per the Fetch Living Standard §3.2 and §4.10: whether a preflight OPTIONS is required, whether the main request is allowed, which response headers the script can read, and which rule killed it when it is denied. No network — the policy is an input, not fetched. Catches the three bugs every stack reinvents: Access-Control-Allow-Origin: '*' with credentials, wildcard allow-headers with credentials, and forbidden request headers like Cookie that the spec blocks before the policy is consulted.\n\nPrice: 0.005 USDC on Base (x402).","x-x402-price-usdc":"0.005","x-x402-amount":"5000","x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.005"}},"x-audience":"developer","x-sample-url":"https://agents.writerslogic.com/api/v1/samples/cors-preflight","security":[{"x402":[]},{"apiKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["request","policy"],"properties":{"request":{"type":"object","required":["origin","method"],"properties":{"origin":{"type":"string","maxLength":200,"description":"The ASCII serialization of the request's origin, e.g. 'https://app.example.com'. 'null' for opaque origins."},"method":{"type":"string","maxLength":20,"description":"HTTP method of the main request (not the preflight), e.g. 'POST'."},"url":{"type":"string","maxLength":2000,"description":"Target URL, optional. Not used in the Fetch decision; carried through for logging."},"headers":{"type":"object","description":"Request headers the main request will send. Names are case-insensitive."},"withCredentials":{"type":"boolean","description":"True if the request uses credentials mode 'include'."}}},"policy":{"type":"object","properties":{"allowOrigin":{"anyOf":[{"type":"string","maxLength":200},{"type":"array","items":{"type":"string","maxLength":200},"maxItems":100}],"description":"The Access-Control-Allow-Origin value, as a string ('*' or an origin) or an array of permitted origins the server echoes from."},"allowMethods":{"type":"array","items":{"type":"string","maxLength":20},"maxItems":20,"description":"Access-Control-Allow-Methods. '*' is accepted (ignored with credentials)."},"allowHeaders":{"type":"array","items":{"type":"string","maxLength":100},"maxItems":100,"description":"Access-Control-Allow-Headers (case-insensitive). '*' is accepted (ignored with credentials)."},"allowCredentials":{"type":"boolean","description":"Access-Control-Allow-Credentials: true."},"exposeHeaders":{"type":"array","items":{"type":"string","maxLength":100},"maxItems":100,"description":"Access-Control-Expose-Headers."},"maxAge":{"type":"integer","description":"Access-Control-Max-Age in seconds."}}}}},"example":{"request":{"origin":"https://app.example.com","method":"POST","headers":{"content-type":"application/json","authorization":"Bearer x"},"withCredentials":true},"policy":{"allowOrigin":["https://app.example.com"],"allowMethods":["POST"],"allowHeaders":["authorization","content-type"],"allowCredentials":true,"maxAge":600}}}}},"responses":{"200":{"description":"Paid result with provenance","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"allowed":{"type":"boolean","description":"Whether the main request (after any preflight) would succeed."},"preflightRequired":{"type":"boolean","description":"Whether the browser would first send OPTIONS."},"preflightResponse":{"type":"object","description":"The headers the server must return on the OPTIONS preflight for this request to be approved."},"exposedResponseHeaders":{"type":"array","items":{"type":"string"},"description":"Response headers that would be visible to the script (CORS-safelisted plus Access-Control-Expose-Headers)."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]}}}},"400":{"description":"Invalid request (no payment consumed)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"401":{"description":"Invalid X-API-KEY","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"402":{"description":"Payment required or invalid","content":{"application/json":{"schema":{"type":"object","description":"x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"code":{"type":"string"},"resource":{"type":"object"},"accepts":{"type":"array","items":{"type":"object"}},"extensions":{"type":"object"}}}}}},"502":{"description":"Upstream failure; the payment is released or not settled","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}}}},"links":{"docs":"https://agents.writerslogic.com/docs/cors-preflight/","docsJson":"https://agents.writerslogic.com/docs/cors-preflight.json","sample":"https://agents.writerslogic.com/api/v1/samples/cors-preflight","openapi":"https://agents.writerslogic.com/openapi.json","catalog":"https://agents.writerslogic.com/api/v1/catalog","verifyProvenance":"https://agents.writerslogic.com/api/v1/verify-provenance","index":"https://agents.writerslogic.com/docs/index.json"}}