# Quick Start - CORS Configuration

### Enable CORS

The CORS configuration is an API-Only configuration, and requires access to the API playground to set these values.

Open the Playground for the `v1` endpoint e.g. `https://mycluster.com/docs/v1/playground`&#x20;

First, select `Authorize` and enter a administrator username and password to allow changes to be made. Once authenticated find the endpoint `PATCH /cluster/{id}/security/cors`

![CORS Endpoints](https://4095106604-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LhZl1ijzJsQtWdyQE3k%2F-M5MFTWpGt8axLxgClvH%2F-M5MGoSqdOC0FL0CJ1W-%2Fimage.png?alt=media\&token=2274c9a8-ad95-467d-b280-b43d79a9e501)

After expanding the PATCH endpoint, press `Try it out` to open the API request for editing and leaving the ID as `me` we can set the following `cors_configuration` value.

#### Controlled Configuration

Using this configuration, we can lock down the CORS requests from specific hosts and controls which headers are permitted for the requests (this includes the majority headers used by vCloud Director):

```
{ 
  "isEnabled": true, 
  "allowedOrigins": "vcd-cell.rubrik.com", 
  "allowedHeaders": "Authorization, Origin, X-Requested-With, Content-Type, Accept, x-vcloud-authorization" 
}
```

#### Wide Open Configuration

Using the configuration will allow CORS request to made to the cluster from any location:

```
{ 
  "isEnabled": true, 
  "allowedOrigins": "*", 
  "allowedHeaders": "*" 
}
```
