---
title: "CORS preflight for the sandbox acting-capacity mirror"
method: OPTIONS
path: "/api/v1/sandbox/altinn/list-acting-capacity"
tags: ["Sandbox"]
---

# CORS preflight for the sandbox acting-capacity mirror

`OPTIONS /api/v1/sandbox/altinn/list-acting-capacity`

## Request

- Base URL: `https://www.apier.no`
- URL: `https://www.apier.no/api/v1/sandbox/altinn/list-acting-capacity`
- Auth: none required

Returns 204 with write-side CORS (POST/OPTIONS, `Authorization` on Allow-Headers, Allow-Credentials: false).

## Response `204`

CORS preflight response for the write-side endpoints (`/api/v1/sandbox/auth/approval-token`, `/api/v1/sandbox/actions/plan`, `/api/v1/sandbox/actions/execute`). Differs from `SandboxOptionsPreflight` in four deliberate ways: (1) Allow-Methods is `POST, OPTIONS` not `GET, OPTIONS`; (2) Allow-Headers list includes `Authorization` (sandbox is auth-gated; browser preflights must allow the header or the cross-origin POST fails CORS before the handler runs); (3) `Access-Control-Allow-Credentials: false` is set explicitly (Bearer tokens flow cross-origin with credentials=false; only cookies require credentials=true); (4) Max-Age is 86400 (24h, not 1h) — preflight stable across the entire deploy.

---

[API](https://skmtc.dev/apier/apis/apier-no-api.md) · [All operations](https://skmtc.dev/apier/apis/apier-no-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apier/apis/apier-no-api/revisions/9ec19bc87311?raw)