---
schema_version: "1"
id: 9b459026fbe2b2ec80c38f69522b56ba7ba6699369f6186777e57dfdf094c6f6
title: Cors
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/references/generated-api-specs/cors.md
canonical_url: https://developer.salesforce.com/docs/commerce/commerce-api/references/cors
source_site: developer.salesforce.com
content_type: documentation
content_hash: ea2b81c983b347dad0f0ac0feb65d1e083f4db383f4fa7a2253d8e54bae7fdfe
products:
  - B2C Commerce API
  - Salesforce APIs
---
Cors

# Cors

[Download API specification](https://developer.salesforce.com/static/commercecloud/commerce-api/cors/cors-oas-v1-public.yaml)

## API Overview

The CORS Preferences API allows you to manage your Cross-Origin Resource Sharing (CORS) preferences.

By specifying which domains are permitted to access a site, you can define exceptions to the same-site policy that browsers would otherwise enforce.

### Authentication & Authorization

For resource access, you must use a client ID and client secret from Account Manager to request an access token. The access token is used as a bearer token and added to the Authorization header of your API request.

You must include `sfcc.cors-preferences.rw` (read-write access) or `sfcc.cors-preferences` (read-only access) in the client ID used to generate the token. For a full list of permissions, see the [Authorization Scopes Catalog.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/auth-z-scope-catalog.html)

For detailed setup instructions, see the [Authorization for Admin APIs.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/authorization-for-admin-apis.html)

### Response Details

#### Timeouts

Admin API requests must respond within 60 seconds. If a response exceeds this threshold, an HTTP 504 status code is returned. For details, see [Timeouts and Limits.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/timeouts-limits.html)

#### Error Handling

Error responses follow the [RFC 7807](https://datatracker.ietf.org/doc/html/rfc7807) problem detail format. To trace errors, include a `correlation-id` header in your request — the response returns it as `x-correlation-id`. For details, see [HTTP Status Codes and Errors.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/error-response-codes.html)

### Use Cases

#### Manage CORS configuration

You can use the preferences/cors endpoint to retrieve, set, or delete your configuration for CORS origins.

### Usage Notes

1.  This configuration is made per client ID and site.
2.  All known domain names and aliases are added to the list automatically and do not need to be configured for CORS explicitly.
3.  If a configuration is absent, CORS will not be active. To enable cors for a client without specifying custom origins, configure the client and site with an empty origin list. The known domain names and aliases will still apply.

**Version:** 1.1.1

## Servers

*   `https://{shortCode}.api.commercecloud.salesforce.com/configuration/cors/v1`
    *   `shortCode (default shortCode) An eight-character string assigned to a realm for routing purposes. See [Base URL and Request Formation.](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html)`

## Security

*   `AmOAuth2` (oauth2) AccountManager OAuth 2.0 bearer token Authentication.
    *   OAuth flow clientCredentials (tokenUrl: https://account.demandware.com/dwsso/oauth2/access\_token)
    *   Scope sfcc.cors-preferences: CORS preferences READONLY scope
    *   Scope sfcc.cors-preferences.rw: CORS preferences scope
    *   OAuth flow authorizationCode (authorizationUrl: https://account.demandware.com/dwsso/oauth2/authorize, tokenUrl: https://account.demandware.com/dwsso/oauth2/access\_token, refreshUrl: https://account.demandware.com/dwsso/oauth2/access\_token)

## Operations

### GET Return all CORS preferences for the given site.

`GET /organizations/{organizationId}/cors`

Operation ID: `getCorsPreferences`. Security: AmOAuth2 (sfcc.cors-preferences, sfcc.cors-preferences.rw).

Return all CORS preferences for the given site.

#### Parameters

*   `organizationId` (path, OrganizationId, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#realm-id) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#instance-id).
    
    _Example_
    
    ```
    f_ecom_zzxy_prd
    ```
    
*   `siteId` (query, SiteId, required) The identifier of the site that a request is being made in the context of. Attributes might have site specific values, and some objects may only be assigned to specific sites.
    
    _Example: SiteId_
    
    ```
    RefArch
    ```
    

#### Responses

*   **200** CORS preferences for the given site returned successfully.
    
    Media type: `application/json`. Schema: `CorsPreferences`.
    
    _Example: getCorsResultWithMappingsExample_
    
    ```
    {
      "corsClientPreferences": [
        {
          "clientId": "12345678-90ab-cdef-fedc-ba0987654321",
          "origins": [
            "http://foo.com",
            "https://foo.bar.com",
            "myapp://example.com"
          ]
        }
      ]
    }
    ```
    
    _Example: getCorsResultWithoutMappingsExample_
    
    ```
    {}
    ```
    

### PUT Create or replace all CORS preferences for the given site.

`PUT /organizations/{organizationId}/cors`

Operation ID: `updateCorsPreferences`. Security: AmOAuth2 (sfcc.cors-preferences.rw).

Create or replace all CORS preferences for the given site.

#### Parameters

*   `organizationId` (path, OrganizationId, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#realm-id) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#instance-id).
    
    _Example_
    
    ```
    f_ecom_zzxy_prd
    ```
    
*   `siteId` (query, SiteId, required) The identifier of the site that a request is being made in the context of. Attributes might have site specific values, and some objects may only be assigned to specific sites.
    
    _Example: SiteId_
    
    ```
    RefArch
    ```
    

#### Request body (required)

Media type: `application/json`. Schema: `CorsPreferences`.

_Example CorsPutBodyExample: same as GET /organizations/{organizationId}/cors 200 response._

#### Responses

*   **200** CORS preferences for the given site replaced successfully.
    
    Media type: `application/json`. Schema: `CorsPreferences`.
    
    _Example updateCorsResultWithMappingsExample: same as GET /organizations/{organizationId}/cors 200 response._
    
    _Example: updateCorsResultWithoutMappingsExample_
    
    ```
    {}
    ```
    
*   **201** CORS preferences successfully created for the given site.
    
    Media type: `application/json`. Schema: `CorsPreferences`.
    
    _Example updateCorsResultWithMappingsExample: same as GET /organizations/{organizationId}/cors 200 response._
    
    _Example: updateCorsResultWithoutMappingsExample_
    
    ```
    {}
    ```
    
*   **400**
    
    Possible reasons:
    
    *   The clientId is missing.
    *   The domain names in the origins list are invalid.
    
    Media type: `application/json`. Schema: `ErrorResponse`.
    
    _Example: CorsBadRequestMissingClientIdExample_
    
    ```
    {
      "title": "Bad Request",
      "type": "https://api.commercecloud.salesforce.com/documentation/error/v1/errors/bad-request",
      "detail": "Submitted content was invalid: Client ID must not be null or empty",
      "parameter": "Submitted content was invalid: Client ID must not be null or empty"
    }
    ```
    
    _Example: CorsBadRequestInvalidDomainNamesExample_
    
    ```
    {
      "title": "Bad Request",
      "type": "https://api.commercecloud.salesforce.com/documentation/error/v1/errors/bad-request",
      "detail": "Submitted content was invalid: Origins must contain only valid domain names in the format '<scheme>://<domain>.<tld>', without a port or path.",
      "parameter": "Submitted content was invalid: Origins must contain only valid domain names in the format '<scheme>://<domain>.<tld>', without a port or path."
    }
    ```
    

### DELETE Delete all CORS preferences for the given site.

`DELETE /organizations/{organizationId}/cors`

Operation ID: `deleteCorsPreferences`. Security: AmOAuth2 (sfcc.cors-preferences.rw).

Delete all CORS preferences for the given site.

#### Parameters

*   `organizationId` (path, OrganizationId, required) An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#realm-id) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#instance-id).
    
    _Example_
    
    ```
    f_ecom_zzxy_prd
    ```
    
*   `siteId` (query, SiteId, required) The identifier of the site that a request is being made in the context of. Attributes might have site specific values, and some objects may only be assigned to specific sites.
    
    _Example: SiteId_
    
    ```
    RefArch
    ```
    

#### Responses

*   **204** CORS preferences for the given site deleted successfully.

## Schemas

### OrganizationId

An identifier for the Salesforce Commerce Cloud organization the request is being made by. It consists of a prefix 'f\_ecom\_' followed by a 4-character [realm identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#realm-id) and a 3-character [instance type identifier](https://developer.salesforce.com/docs/commerce/commerce-api/guide/base-url.html#instance-id).

Type: `string`.

Pattern: ^f\_ecom\_\[a-z\]{4}\_(prd|stg|dev|s\[0-9\]{2}|\[0-9\]{3})$. Example: `f_ecom_zzxy_prd`.

### SiteId

The identifier of the site that a request is being made in the context of. Attributes might have site specific values, and some objects may only be assigned to specific sites

Type: `string`.

Minimum length: 1. Maximum length: 32. Example: `RefArch`.

### CorsPreferences

Document representing all CORS preferences for a given site

*   `corsClientPreferences` (_array of CorsClientPreferences_) List of client-specific CORS preferences

### ErrorResponse

*   `title` (_string_, required) A short, human-readable summary of the problem type. It will not change from occurrence to occurrence of the problem, except for purposes of localization  
    Maximum length: 256. Example: `You do not have enough credit`.
*   `type` (_string_, required) A URI reference \[RFC3986\] that identifies the problem type. This specification encourages that, when dereferenced, it provide human-readable documentation for the problem type (e.g., using HTML \[W3C.REC-html5-20141028\]). When this member is not present, its value is assumed to be "about:blank". It accepts relative URIs; this means that they must be resolved relative to the document's base URI, as per \[RFC3986\], Section 5.  
    Maximum length: 2048. Example: `NotEnoughMoney`.
*   `detail` (_string_, required) A human-readable explanation specific to this occurrence of the problem.  
    Example: `Your current balance is 30, but that costs 50`.
*   `instance` (_string_) A URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced. It accepts relative URIs; this means that they must be resolved relative to the document's base URI, as per \[RFC3986\], Section 5.  
    Maximum length: 2048. Example: `/account/12345/msgs/abc`.

### CorsClientPreferences

Document representing all CORS preferences of a specific client

*   `clientId` (_string_, required) Client ID  
    Pattern: ^\[-a-zA-Z0-9\]+$. Example: `12345678-90ab-cdef-fedc-ba0987654321`.
*   `origins` (_array of string_, required) List containing allowed origins in the format '://.'  
    Items: Pattern: ^\[a-zA-Z\_0-9\]\[-.+a-zA-Z\_0-9\]+://\[-.a-zA-Z\_0-9\]{1,253}$.