List allowed origins
Returns the CORS allowlist for the current store. Each entry is a
bare scheme://host[:port] permitted to call the admin API from a
browser. Backs the Rack::Cors allowlist and the CSRF boundary of
the admin cookie session (see
docs/plans/5.5-admin-auth-cookie-refresh.md).
Required scope: read_api_keys (for API-key authentication).
Filters
Filter withq[<attribute>_<predicate>]=value, for example q[origin_cont]=…. Send a list as q[<attribute>_in][]=a&q[<attribute>_in][]=b. How filters work.
created_at, id, origin, updated_at. Prefix a field with - to sort descending.Authorizations
Secret API key for admin access
JWT token for admin user authentication
Headers
Bearer token for admin authentication
Query Parameters
Matches any of origin (partial, case-insensitive).
Page number
Number of records per page
Attribute filters, as q[<attribute>_<predicate>]=value. See Filters above for the list.
Sort by field. Prefix with - for descending (e.g., -created_at).
Comma-separated list of fields to include. id is always included.

