{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":436,"path":"api-reference/rest-api-explorer/t_DefineACORSRule.md","title":"Define a CORS rule","bundle":null,"doc_type":null,"release":"australia","body":"\n# Define a CORS rule\n\nYou can define a CORS rule to control which domains can access REST API endpoints and other web resources.\n\n## Before you begin\n\nRole required: cors\\_rule\\_admin, web\\_service\\_admin, or admin\n\n## Procedure\n\n1.  Navigate to **All** &gt; **System Web Services** &gt; **REST** &gt; **CORS Rules**.\n\n2.  Select **New**.\n\n3.  On the form, fill in the fields.\n\n<table id=\"table_o13_rs3_ls\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nName\n\n</td><td>\n\nEnter a unique name for the rule.\n\n</td></tr><tr><td>\n\nUse Resource Path\n\n</td><td>\n\nSelect this option to specify a path to a web resource. For REST APIs, leave this option cleared.\n\n</td></tr><tr><td>\n\nREST API\n\n</td><td>\n\nSelect the REST API for the domain to access, such as the Table API.\n\n</td></tr><tr><td>\n\nWeb Resource Path\n\n</td><td>\n\nIf you selected **Use Resource Path**, enter a path to the web resource for the domain to access.\n\n</td></tr><tr><td>\n\nDomain\n\n</td><td>\n\nEnter the domain to access the specified REST API or web resource. This CORS rule is evaluated against requests from the specified domain.You can specify a domain pattern or an IP address. When using a domain pattern, you can use the wildcard character \\(`*`\\) to match incoming origin headers.\n\n</td></tr><tr><td>\n\nMax age\n\n</td><td>\n\nEnter the number of seconds to cache the client session. After an initial CORS request, further requests from the same client within the specified time don’t require a preflight message.If you don’t specify a value, the default value of 0 indicates that all requests require a preflight message.\n\n</td></tr><tr><td>\n\nFor Embeddables\n\n</td><td>\n\nReserved for future use.\n\n</td></tr><tr><td>\n\nActive\n\n</td><td>\n\nSelect this option turn on the CORS rule.\n\n</td></tr></tbody>\n</table>4.  Select the **HTTP Methods** tab and the HTTP methods allowed.\n\n    Only the selected methods can be called from the specified domain.\n\n5.  Select the **HTTP Headers** tab and fill in the fields.\n\n    |Field|Description|\n    |-----|-----------|\n    |Access-Control-Allow-Credentials|Option to allow sending credentials in the request. If this option is enabled, you can't use a wildcard in the **Domain** field.|\n    |Access-Control-Allow-Headers|Enter a comma-separated list of HTTP headers to allow in the request or the wildcard character \\(`*`\\) to allow any header.|\n    |Access-Control-Expose-Headers|Enter a comma-separated list of HTTP headers to send in the response.|\n\n6.  Select **Submit**.\n\n\n**Parent Topic:**[REST APIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md)\n\n"}}