CORS preflight for the sandbox execute endpoint
Returns 204 with write-side CORS (POST/OPTIONS, Authorization on Allow-Headers, Allow-Credentials: false). approval_token is in the body, NOT a header — so X-Approval-Token is NOT advertised in Allow-Headers.
Request
- Base URL: https://www.apier.no
- URL: https://www.apier.no/api/v1/sandbox/actions/execute
- Auth: none required
Response
CORS preflight response for the write-side endpoints (/api/v1/sandbox/auth/approval-token, /api/v1/sandbox/actions/plan, /api/v1/sandbox/actions/execute). Differs from SandboxOptionsPreflight in four deliberate ways: (1) Allow-Methods is POST, OPTIONS not GET, OPTIONS; (2) Allow-Headers list includes Authorization (sandbox is auth-gated; browser preflights must allow the header or the cross-origin POST fails CORS before the handler runs); (3) Access-Control-Allow-Credentials: false is set explicitly (Bearer tokens flow cross-origin with credentials=false; only cookies require credentials=true); (4) Max-Age is 86400 (24h, not 1h) — preflight stable across the entire deploy.
Changes
No recorded changes to this operation across all 1 revision of this API.