---
sourceDocument: Xanadu API Reference
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/api-reference

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu API Reference

ft:clusterId :

    - crapiref

bundleId :

    - crapiref

workflow :

    - Creator


---

# Define a CORS rule

# Define a CORS rule {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

You can define a CORS rule to control which domains can access REST API endpoints and other web resources.

## Before you begin

Role required: cors_rule_admin, web_service_admin, or admin

## Procedure

1. Navigate to AllSystem Web ServicesRESTCORS Rules.
2. Select New.
3. On the form, fill in the fields.  
   {#t_DefineACORSRule__table_o13_rs3_ls__entry__2}

   | Field | Description |
   |-|-|
   | Name | Enter a unique name for the rule. |
   | Use Resource Path | Select this option to specify a path to a web resource. For REST APIs, leave this option cleared. |
   | REST API | Select the REST API for the domain to access, such as the Table API. |
   | Web Resource Path | If you selected Use Resource Path, enter a path to the web resource for the domain to access. |
   | Domain | Enter the domain to access the specified REST API or web resource. This CORS rule is evaluated against requests from the specified domain. You can specify a domain pattern or an IP address. When using a domain pattern, you can use the wildcard character (<kbd class="ph userinput">*</kbd>) to match incoming origin headers. |
   | Max age | Enter the number of seconds to cache the client session. After an initial CORS request, further requests from the same client within the specified time don't require a preflight message. If you don't specify a value, the default value of 0 indicates that all requests require a preflight message. |
   | For Embeddables | Reserved for future use. |
   | Active | Select this option turn on the CORS rule. |
   [Table 1. CORS Rule form]

   {#t_DefineACORSRule__table_o13_rs3_ls}
4. Select the HTTP Methods tab and the HTTP methods allowed.  
   Only the selected methods can be called from the specified domain.
5. Select the HTTP Headers tab and fill in the fields.  
   {#t_DefineACORSRule__table_zdw_dx5_gbc__entry__2}

   | Field | Description |
   |-|-|
   | Access-Control-Allow-Credentials | Option to allow sending credentials in the request. If this option is enabled, you can't use a wildcard in the Domain field. |
   | Access-Control-Allow-Headers | Enter a comma-separated list of HTTP headers to allow in the request or the wildcard character (<kbd class="ph userinput">*</kbd>) to allow any header. |
   | Access-Control-Expose-Headers | Enter a comma-separated list of HTTP headers to send in the response. |
   [Table 2. HTTP Headers section]

   {#t_DefineACORSRule__table_zdw_dx5_gbc}
6. Select Submit.
{#t_DefineACORSRule__steps_xkn_ns3_ls}

*[\>]: and then