GET/api/resource-server/apis/{api_server_id}/allowed-originsAuthenticated

List a resource server's allowed CORS origins

Returns the origins a resource server should accept cross-origin requests from: the union of the domains, in this deployment's app environment, of every client application connected to the API server. The response is sent with Cache-Control: no-store. Resource servers built on @schemavaults/auth-server-sdk call this through RemoteAllowedOriginsResolver.

operationId get_api_resource_server_apis_api_server_id_allowed_originsResource servers

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user
Notes
The assertion's iss / sub must equal the api_server_id path parameter, so a resource server can only query its own allowed origins. Every assertion is accepted once.

Path parameters

NameTypeDescription
api_server_id*string

API server id; must equal the assertion's issuer

Responses

application/json
ResourceServerAllowedOriginsResponse
PropertyTypeDescription
success*true
data*object
api_server_id*string

minLength: 2maxLength: 64pattern: ^[a-z0-9_-]*$

environment*"development" | "staging" | "test" | "production"

The app environment whose client app domains were collected

origins*string[]

Sorted, de-duplicated origins

JSONExample
"success"true
"data"
"api_server_id""string"
"environment""development"
"origins"
"https://app.example.com"

Example request

bashcurl
curl -X GET 'https://auth.schemavaults.com/api/resource-server/apis/<api_server_id>/allowed-origins' \
  -H 'Authorization: Bearer <access_token>'