Get Cross-Origin Resource Sharing (CORS) Rules Set on a Specified Bucket
Updated at：2025-11-03
API description
This API fetches the current CORS rules of a specified bucket.
Permission description Only the bucket owner or users granted with FULL_CONTROL permission can set bucket CORS. 403 Forbidden error will be returned with the error code AccessDenied when permission is not granted. AccessDenied.
Request URI
GET /v1/{bucketName}/?cors
| Parameter name | Parameter type | Required or not | Description | Example value | Parameter location |
|---|---|---|---|---|---|
| bucketName | String | Yes | Bucket name | "bucketName_example" | Path |
Parameters of request body
Description of the data structure of request body fields
| Parameter name | Parameter type | Required or not | Description | Example value |
|---|---|---|---|---|
| corsConfiguration | List |
Yes | Defines container rules for bucket CORS. Each bucket can have up to 100 rules, executed in order from top to bottom if multiple configurations exist. |
Description of CorsConfiguration field data structure
| Parameter name | Parameter type | Required or not | Description | Example value |
|---|---|---|---|---|
| allowedOrigins | List |
Yes | A container that stores the allowed origins for cross-origin requests. | |
| allowedMethods | List |
Yes | A container that stores the allowed methods for cross-origin requests. | |
| allowedHeaders | List |
Yes | A container that specifies allowed headers. It determines whether the headers listed in the Access-Control-Request-Headers of an OPTIONS preflight request are permitted. | |
| allowedExposeHeaders | List |
No | A container that stores the response headers accessible to users from applications. | |
| maxAgeSeconds | Integer | No | Set the browser's cache duration (in seconds) for the responses to preflight (OPTIONS) requests. During this set time, duplicate preflight requests will not be sent. Type: Int64. | 1800 |
Response body parameters
Description of the data structure of response body fields
| Parameter name | Parameter type | Description | Example value |
|---|---|---|---|
| corsConfiguration | List |
A container for bucket CORS rules, with each bucket supporting up to 100 rules. If multiple configurations exist, they are processed in top-to-bottom order. |
Description of CorsConfiguration field data structure
| Parameter name | Parameter type | Description | Example value |
|---|---|---|---|
| allowedOrigins | List |
A container that stores the allowed origins for cross-origin requests. | |
| allowedMethods | List |
A container that stores the allowed methods for cross-origin requests. | |
| allowedHeaders | List |
A container that stores the allowed headers, controlling whether the headers specified in the Access-Control-Request-Headers of the OPTIONS prefetch request are permitted. | |
| allowedExposeHeaders | List |
A container that stores the response headers accessible to users from applications. | |
| maxAgeSeconds | Long | Specifies the cache duration (in seconds) in the browser for the OPTIONS prefetch response results, during which repeated prefetch requests are not required. Type: Int64. | 1800 |
Request example
JSON
1GET /v1/bucketName_example/?cors
2 <Common request headers>
3{
4 "corsConfiguration" : [ {
5 "allowedExposeHeaders" : [ "user-custom-expose-header" ],
6 "allowedOrigins" : [ "http://www.example.com" ],
7 "allowedHeaders" : [ "Authorization" ],
8 "allowedMethods" : [ "GET" ],
9 "maxAgeSeconds" : 1800
10 } ]
11}Response example
JSON
1HTTP/1.1 200 OK
2 <Common response headers>
3{
4 "corsConfiguration" : [ {
5 "allowedExposeHeaders" : [ "user-custom-expose-header", "user-custom-expose-header" ],
6 "allowedOrigins" : [ "http://www.example.com", "http://www.example.com" ],
7 "allowedHeaders" : [ "Authorization", "Authorization" ],
8 "allowedMethods" : [ "GET", "GET" ],
9 "maxAgeSeconds" : 1800
10 }, {
11 "allowedExposeHeaders" : [ "user-custom-expose-header", "user-custom-expose-header" ],
12 "allowedOrigins" : [ "http://www.example.com", "http://www.example.com" ],
13 "allowedHeaders" : [ "Authorization", "Authorization" ],
14 "allowedMethods" : [ "GET", "GET" ],
15 "maxAgeSeconds" : 1800
16 } ]
17}Error code
Please refer to the general error codes