Set Bucket CORS Policy

client.r2.buckets.cors.update(, , ?): CORSUpdateResponse

PUT/accounts/{account_id}/r2/buckets/{bucket_name}/cors

Replaces the Cross-Origin Resource Sharing (CORS) rules for an R2 bucket. Rules specify which origins, methods, and headers are allowed for browser requests to objects in the bucket.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

ParametersExpand Collapse

bucketName: string

Name of the bucket.

maxLength64

minLength3

params: CORSUpdateParams { account_id, rules, cfR2Jurisdiction }

account_id: string

Path param: Cloudflare account ID that owns the R2 resource.

maxLength32

rules?: Array<Rule>

Body param

allowed: Allowed { methods, origins, headers }

Object specifying allowed origins, methods and headers for this CORS rule.

methods: Array<"GET" | "PUT" | "POST" | 2 more>

Specifies the value for the Access-Control-Allow-Methods header R2 sets when requesting objects in a bucket from a browser.

One of the following:

"GET"

"PUT"

"POST"

"DELETE"

"HEAD"

origins: Array<string>

Specifies the value for the Access-Control-Allow-Origin header R2 sets when requesting objects in a bucket from a browser.

headers?: Array<string>

Specifies the value for the Access-Control-Allow-Headers header R2 sets when requesting objects in this bucket from a browser. Cross-origin requests that include custom headers (e.g. x-user-id) should specify these headers as AllowedHeaders.

id?: string

Identifier for this rule.

exposeHeaders?: Array<string>

Specifies the headers that can be exposed back, and accessed by, the JavaScript making the cross-origin request. If you need to access headers beyond the safelisted response headers, such as Content-Encoding or cf-cache-status, you must specify it here.

maxAgeSeconds?: number

Specifies the amount of time (in seconds) browsers are allowed to cache CORS preflight responses. Browsers may limit this to 2 hours or less, even if the maximum value (86400) is specified.

cfR2Jurisdiction?: "default" | "eu" | "us" | 2 more

Header param: Jurisdiction where objects in this bucket are guaranteed to be stored.

One of the following:

"default"

"eu"

"us"

"fedramp"

"fedramp-high"

ReturnsExpand Collapse

CORSUpdateResponse = unknown

Set Bucket CORS Policy

import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const cors = await client.r2.buckets.cors.update('example-bucket', {
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

console.log(cors);

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    "string"
  ],
  "result": {},
  "success": true
}

Returns Examples

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    "string"
  ],
  "result": {},
  "success": true
}