---
sourceDocument: Zurich Employee Service Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/employee-service-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Employee Service Management

ft:clusterId :

    - emplsm

bundleId :

    - emplsm

workflow :

    - Employee


---

# Allow cross-domain requests to REST APIs

# Allow cross-domain requests to REST APIs {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Allow cross-domain requests to REST APIs from a browser-based application in a different domain by creating a record in CORS rules through the Microsoft Viva Connections Integration application scope.

## Before you begin

Role required: admin

## Procedure

1. Navigate to AllSystem Web ServicesRESTCORS Rules.
2. Select New.
3. On the form, fill in the fields.  
   {#update-cors-rules-viva__table_zxz_qzb_gyb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name for the CORS rule. |
   | Application | Application containing the associated CORS record. This field is automatically set to Employee Center for Microsoft Viva Connections. |
   | REST API | The REST API this CORS rule applies to. Enter <kbd class="ph userinput">Microsoft VIVA Integration [sn_now_ms_viva/viva]</kbd>. |
   | Domain | The domain that this CORS rule applies to. Enter <kbd class="ph userinput">https://{tenantName}.sharepoint.com</kbd>. For example, https://nowhkconnect.sharepoint.com. This CORS rule is evaluated against requests from the specified domain. You can specify a domain pattern or an IP address. |
   | Max age | The number of seconds to cache the client session. After an initial CORS request, further requests from the same client within the specified time do not require a preflight message. If you do not specify a value, the default value of 0 indicates that all requests require a preflight message. |
   | HTTP Methods tab | The HTTP methods allowed. Only the selected methods can be called from the specified domain. The available methods are: * GET * POST * PUT * PATCH * DELETE {#update-cors-rules-viva__ul_ayz_qzb_gyb} |
   | HTTP Headers tab ||
   | Exposed headers | List of headers that the browser is allowed to access from the request. |
   [Table 1. CORS rule form]

   {#update-cors-rules-viva__table_zxz_qzb_gyb}
4. Select Submit.

*[\>]: and then