---
title: "🛡️ Add a custom CORS origin."
method: POST
path: "/api/v1/cors-origins"
tags: ["CORS Origins"]
---

# 🛡️ Add a custom CORS origin.

`POST /api/v1/cors-origins`

<h3>🛡️ Requires Capabilities: <code>ServerSettings.Update</code></h3>

## Request body

- AddCorsOriginDto
  - `origin` string, required — The origin to allow, as a well-formed http:// or https:// URL. Only the scheme, host, and port are kept.

## Response `201`

- CorsOrigin
  - `corsOriginId` string, required
  - `origin` string, required
  - `addedByUserId` string
  - `id` number, required
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required
  - `deletedAt` string, date-time, required

## Other responses

- `400` — Possible reasons: Request validation failed, see response for details; The origin is not a well-formed http(s) URL.
- `401` — Possible reasons: The authorization token is invalid.
- `403` — Possible reasons: The user does not have sufficent capabilities.

## Changes

- **2026-08-09** `0a6b12031de9` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/cardinalapps/apis/cardinal-media-server-api/changes/api/v1/cors-origins/post.md)

---

[API](https://skmtc.dev/cardinalapps/apis/cardinal-media-server-api.md) · [All operations](https://skmtc.dev/cardinalapps/apis/cardinal-media-server-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cardinalapps/cardinal-media-server-api/revisions/7b5e4555e84f/schema)