---
title: "Register a browser origin"
method: POST
path: "/workspaces/{workspaceId}/cors-origins"
tags: ["Workspaces"]
---

# Register a browser origin

`POST /workspaces/{workspaceId}/cors-origins`

## Request

- Base URL: `https://tasg.app/api/v1`
- URL: `https://tasg.app/api/v1/workspaces/{workspaceId}/cors-origins`
- Auth: HTTP bearer

Workspace owner only, max 10 per workspace. Registering an origin makes the API answer CORS for it (without cookies; requests still need a `tf_` bearer token), so a web app served from that origin can call `/api/v1` directly from the browser. https only (http allowed for localhost); scheme + host (+ port) only, no wildcards. Takes up to a minute to propagate. Idempotent.

## Path parameters

- `workspaceId` string, uuid, required

## Request body

- object
  - `origin` string, required: e.g. `https://app.example.com`

## Response `201`

Registered (or already present).

- object
  - `origin` AllowedOrigin, required
    - `id` string, uuid, required
    - `origin` string, required: Normalised origin: scheme + host (+ port), e.g. `https://app.example.com`.
    - `created_at` string, date-time, required

## Other responses

- `400`: Validation failed: the body or query did not match the schema, or a business rule was violated. `error` says which.
- `401`: Missing, invalid, expired or revoked credentials.
- `403`: Authenticated, but not allowed: not a member, insufficient project role or the API token lacks the required scope.
- `429`: Rate limited. Back off and retry after the window in the `RateLimit-*` headers.

---

[API](https://skmtc.dev/tasg/apis/tasg-api.md) · [All operations](https://skmtc.dev/tasg/apis/tasg-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tasg/apis/tasg-api/revisions/cd2a1dbaf5cf?raw)