[ Web Proxy ]
URL:
Viewing: https://developers.cloudflare.com/api/resources/r2/subresources/buckets/subresources/cors [Back]  [Original]
CORS | Cloudflare API Skip to content
logo.DMYpXs3t.svg [logo.DMYpXs3t.svg] Cloudflare API
CtrlK
Start here
Start here
HTTP
API Reference
R2
Buckets
Copy Markdown

CORS

Get Bucket CORS Policy
GET/accounts/{account_id}/r2/buckets/{bucket_name}/cors
Put Bucket CORS Policy
PUT/accounts/{account_id}/r2/buckets/{bucket_name}/cors
Delete Bucket CORS Policy
DELETE/accounts/{account_id}/r2/buckets/{bucket_name}/cors
ModelsExpand Collapse
CORSGetResponse object { rules }
rules: optional array of object { allowed, id, exposeHeaders, maxAgeSeconds }
allowed: object { methods, origins, headers }

Object specifying allowed origins, methods and headers for this CORS rule.

methods: array of "GET" or "PUT" or "POST" or 2 more

Specifies the value for the Access-Control-Allow-Methods header R2 sets when requesting objects in a bucket from a browser.

One of the following:
"GET"
"PUT"
"POST"
"DELETE"
"HEAD"
origins: array of string

Specifies the value for the Access-Control-Allow-Origin header R2 sets when requesting objects in a bucket from a browser.

headers: optional array of string

Specifies the value for the Access-Control-Allow-Headers header R2 sets when requesting objects in this bucket from a browser. Cross-origin requests that include custom headers (e.g. x-user-id) should specify these headers as AllowedHeaders.

id: optional string

Identifier for this rule.

exposeHeaders: optional array of string

Specifies the headers that can be exposed back, and accessed by, the JavaScript making the cross-origin request. If you need to access headers beyond the safelisted response headers, such as Content-Encoding or cf-cache-status, you must specify it here.

maxAgeSeconds: optional number

Specifies the amount of time (in seconds) browsers are allowed to cache CORS preflight responses. Browsers may limit this to 2 hours or less, even if the maximum value (86400) is specified.

CORSUpdateResponse = unknown
CORSDeleteResponse = unknown
Previous

Lifecycle
Next

Domains

On this page

Web Proxy Viewer  |  New URL  |  Original Page