CORS pre-flight

note

CORS preflight endpoint for the /crosstab path. Browsers issue this automatically before cross-origin POST requests. No parameters required.

Getting started

URL REQUEST (OPTIONS)

https://engines.api.telmar.com/omg/prd/v1/crosstab

crosstabOptions returns 200 — everything useful is in the response headers. It requires no authentication and is not billed, which also makes it a reasonable liveness probe.

Main parameters

None in the body. Two request headers matter for a real CORS pre-flight:

Pre-flight request headers

Origin: https://app.example.com
Access-Control-Request-Method: POST

Response headers

Header	Meaning
Access-Control-Allow-Origin	Origins allowed to call cross-origin
Access-Control-Allow-Methods	Methods allowed cross-origin
Access-Control-Allow-Headers	Headers you may send (including Telmar-Engine-Authorizer)

Let's go to examples

CORS pre-flight for crosstab

OPTIONS/crosstab200 OKExample

Call this from a browser-based integration to confirm the CORS policy before your first real request, or as a cheap liveness probe. It is not billed.

note

Everything useful is in the response headers — `Access-Control-Allow-Methods` and `Access-Control-Allow-Headers` tell the browser what it may send.

URL REQUEST (OPTIONS)

OPTIONS https://engines.api.telmar.com/omg/prd/v1/crosstab

The same call as curl

curl -X OPTIONS 'https://engines.api.telmar.com/omg/prd/v1/crosstab' \
  -H 'Origin: https://app.example.com' \
  -H 'Access-Control-Request-Method: POST'

We will receive a json like this — 200 OK

{}

What to read next

• Crosstab — the operation being described.
• Getting started — why a browser integration should proxy through your own backend.