Access-Control-Allow-Methods
CORS: lists HTTP methods allowed for cross-origin requests. Sent in response to preflight OPTIONS.
ResponseSyntax
Access-Control-Allow-Methods: <method>[, <method>]*Example values
| Value | Explanation |
|---|---|
| GET, POST, PUT, DELETE | REST API methods |
| GET, OPTIONS | Read-only |
cURL usage
curl -X OPTIONS -H 'Origin: https://app.com' https://api.example.com/users
Common mistakes
Not including OPTIONS; omitting methods the API supports.