---
title: "CORS preflight for the public-sandbox verify endpoint"
method: OPTIONS
path: "/api/v1/sandbox/public/company/{org}/verify"
tags: ["Sandbox"]
---

# CORS preflight for the public-sandbox verify endpoint

`OPTIONS /api/v1/sandbox/public/company/{org}/verify`

## Request

- Base URL: `https://www.apier.no`
- URL: `https://www.apier.no/api/v1/sandbox/public/company/{org}/verify`
- Auth: none required

204 with `Access-Control-Allow-Methods: GET, POST, OPTIONS` (unified across the public-sandbox surface). No credentials.

## Response `204`

CORS preflight for the unauthenticated public-sandbox surface (`/api/v1/sandbox/public/*`). Differs from the internal `SandboxOptionsPreflight` in three places: (1) Allow-Methods is `GET, POST, OPTIONS` — the public surface is unified across both verbs because every public-sandbox endpoint shares one handler factory; (2) `X-Robots-Tag: noindex` is set so the JSON API surface never lands in a search index even if a crawler stumbles onto it; (3) `X-Apier-Sandbox: public` is set as the agent-facing detection signal (SDKs branch on this header to distinguish the public from the internal sandbox without parsing the URL). `Access-Control-Allow-Credentials` is INTENTIONALLY absent — public sandbox is zero-auth and must not advertise credential support.

---

[API](https://skmtc.dev/apier/apis/apier-no-api.md) · [All operations](https://skmtc.dev/apier/apis/apier-no-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apier/apis/apier-no-api/revisions/9ec19bc87311?raw)