---
title: "CreateCORSPolicy"
method: POST
path: "/v1.1/cors_policy"
tags: ["ControlService"]
---

# CreateCORSPolicy

`POST /v1.1/cors_policy`

## Request

- Base URL: `https://www.metarouter.io/contact`
- URL: `https://www.metarouter.io/contact/v1.1/cors_policy`
- Auth: HTTP bearer

Creates or replaces the cluster-level ingestion API CORS policy singleton.

## Request body

- ProtobufControlpbV1CreateCORSPolicyRequest
  - `policy` union
    - object, nullable
    - ProtobufControlpbV1CORSPolicy
      - `allowOrigins` string[], nullable: allow_origins are exact origins or single-wildcard patterns allowed by the policy.
      - `author` string: author records who created or replaced the policy.
      - `enforce` boolean: enforce controls whether denied origins lose CORS approval. When false, the policy is report-only: all origins retain default wildcard approval while would-be denials are recorded.
      - `preflightMaxAge` union: preflight_max_age is required and sets Access-Control-Max-Age in seconds. Values from 1s through 24h are emitted.
        - object, nullable
        - GoogleProtobufDuration
          - `nanos` integer: Signed fractions of a second at nanosecond resolution of the span of time. Durations less than one second are represented with a 0 `seconds` field and a positive or negative `nanos` field. For durations of one second or more, a non-zero value for the `nanos` field must be of the same sign as the `seconds` field. Must be from -999,999,999 to +999,999,999 inclusive.
          - `seconds` string: Signed seconds of the span of time. Must be from -315,576,000,000 to +315,576,000,000 inclusive. Note: these bounds are computed from: 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
      - `updatedAt` string, date-time, nullable: updated_at records when the policy was last created or replaced.

## Response `200`

OK

- ProtobufControlpbV1CreateCORSPolicyResponse
  - `policy` union
    - object, nullable
    - ProtobufControlpbV1CORSPolicy
      - `allowOrigins` string[], nullable: allow_origins are exact origins or single-wildcard patterns allowed by the policy.
      - `author` string: author records who created or replaced the policy.
      - `enforce` boolean: enforce controls whether denied origins lose CORS approval. When false, the policy is report-only: all origins retain default wildcard approval while would-be denials are recorded.
      - `preflightMaxAge` union: preflight_max_age is required and sets Access-Control-Max-Age in seconds. Values from 1s through 24h are emitted.
        - object, nullable
        - GoogleProtobufDuration
          - `nanos` integer: Signed fractions of a second at nanosecond resolution of the span of time. Durations less than one second are represented with a 0 `seconds` field and a positive or negative `nanos` field. For durations of one second or more, a non-zero value for the `nanos` field must be of the same sign as the `seconds` field. Must be from -999,999,999 to +999,999,999 inclusive.
          - `seconds` string: Signed seconds of the span of time. Must be from -315,576,000,000 to +315,576,000,000 inclusive. Note: these bounds are computed from: 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
      - `updatedAt` string, date-time, nullable: updated_at records when the policy was last created or replaced.

## Other responses

- `4XX`: Something is wrong with your request such as missing or invalid data. Correct your request and try again.
- `5XX`: Internal server error. Try again later or reach out to MetaRouter support.

## Changes

- **2026-11-03** `aa3afac506c0`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/metarouter/apis/control-api/changes/v1.1/cors_policy/post.md)

---

[API](https://skmtc.dev/metarouter/apis/control-api.md) - [All operations](https://skmtc.dev/metarouter/apis/control-api/llms.txt) - [OpenAPI document](https://skmtc.dev/metarouter/apis/control-api/revisions/aa3afac506c0?raw)