// HTTP method
OPTIONS
Request communication options for a resource or server. Browsers also use OPTIONS for CORS preflight; a successful preflight is not the actual API request.
SafeIdempotent
Idempotency
Idempotent: repeating the capability query does not request a state change.
Common use cases
- Discover supported methods through Allow when provided.
- Check whether a browser origin may send a cross-origin request.
- Diagnose preflight handling for POST /payments with JSON and authorization headers.
Common mistakes
- Confusing Allow with Access-Control-Allow-Methods.
- Requiring an application bearer token on a browser preflight, which does not carry the actual request's Authorization header.
- Using wildcard Access-Control-Allow-Origin with credentialed browser requests.
- Assuming a 204 alone grants CORS access; inspect origin, method and header permissions.
Request
OPTIONS /payments HTTP/1.1
Host: api.example.com
Origin: https://frontend.example.com
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization, content-typeResponse
HTTP/1.1 204 No Content
Allow: POST, OPTIONS
Access-Control-Allow-Origin: https://frontend.example.com
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Allow-Headers: authorization, content-type
Vary: OriginRelated methods and workflows
// GET STARTED
Design and test a OPTIONS operation.
Define the contract in API Designer, then execute it with Cloud Runner or Browser Runner.