From 683cf76943da50b2538eab7f9a39f5680399f861 Mon Sep 17 00:00:00 2001
From: Michael Bryzek <mbryzek@alum.mit.edu>
Date: Mon, 2 Mar 2026 18:30:06 -0500
Subject: [PATCH] Update CORS Headers

---
 api/conf/base.conf | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/api/conf/base.conf b/api/conf/base.conf
index 4ff8133b6..37f99d178 100644
--- a/api/conf/base.conf
+++ b/api/conf/base.conf
@@ -11,6 +11,14 @@ evolutionplugin=disabled
 
 play.filters.cors.preflightMaxAge = 3 days
 play.filters.cors.allowedHttpMethods = ["DELETE", "GET", "PATCH", "POST", "PUT", "OPTIONS"]
+play.filters.cors.allowedHttpMethods = ["DELETE", "GET", "PATCH", "POST", "PUT", "OPTIONS"]
+play.filters.cors.allowedOrigins = [
+  "https://app.apibuilder.io",
+  "https://app.apibuilder.org",
+  "http://localhost:5173"
+]
+
+
 play.http.errorHandler = "io.apicollective.play.ErrorHandler"
 play.http.filters = "io.apicollective.play.LoggingFilter"
 play.http.parser.maxMemoryBuffer=10M