# CORS issue in API call

**URL:** <https://forum.mautic.org/t/cors-issue-in-api-call/11291>\
**Category:** Product Support\
**Created:** [October 2, 2019, 6:03pm UTC](https://forum.mautic.org/t/cors-issue-in-api-call/11291 "2019-10-02T18:03:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![andres](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/andres/32/817_2.png) [@andres](https://forum.mautic.org/u/andres)\
**Post date:** [October 2, 2019, 6:03pm UTC](https://forum.mautic.org/t/cors-issue-in-api-call/11291/1 "2019-10-02T18:03:49Z")

</div>

**Your software**  
My Mautic version is: Linux mautic 4.15.0-1044-aws #46-Ubuntu SMP  
My PHP version is: PHP Version 7.2.19-0ubuntu0.18.04.2

**Your problem**  
I am trying to make a call to the REST API to retrieve a form submission using JS. I am using basic authentication. I tested the access to the api with curl and works well.  
CORS is enabled and the server URL is configured.

When I use it in JS I get the following error:  
**Access to XMLHttpRequest at ‘https://:@mautic.mysite.link/index.php/api/forms/8/submissions’ from origin ‘[https://test.mysite.com](https://test.mysite.com)’ has been blocked by CORS policy: Request header field access-control-allow-origin is not allowed by Access-Control-Allow-Headers in preflight response.**

This is the code:

```
    <script>
      
        var request = new XMLHttpRequest();
      
        request.open('GET', 'https://mautic.mysite.link/index.php/api/forms/8/submissions', true, "<user>", "<password>");
        request.setRequestHeader("Access-Control-Allow-Origin","*");
    
        request.onload = function() {
            alert("loaded!");
            document.getElementById("result").innerHTML = "Ok!";
        };
    
    request.send();
    </script>
```

---

<div class="post-metadata">

**Author:** ![silavapi](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/silavapi/32/7424_2.png) [@silavapi](https://forum.mautic.org/u/silavapi)\
**Post date:** [January 25, 2021, 8:52pm UTC](https://forum.mautic.org/t/cors-issue-in-api-call/11291/2 "2021-01-25T20:52:56Z")

</div>