Set the allowed origins
Requires api_keys:write. This list is the actual security boundary of a key that is public by design.
Matching is exact on the normalized origin — no wildcards, no prefixes. An empty list allows any origin: that is the getting-started state, and it is what you leave behind before going live.
Autorizações
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange.
Cabeçalhos
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing. Absent, the session's default organization answers.
Parâmetros de caminho
Corpo
Scheme and host, optionally a port. No path, no query, no fragment.
Resposta
Updated.