# POST requests via XMLHttpRequest fails

**URL:** <https://discuss.circleci.com/t/post-requests-via-xmlhttprequest-fails/37512>\
**Category:** API\
**Tags:** 2.0\
**Created:** [September 24, 2020, 6:49pm UTC](https://discuss.circleci.com/t/post-requests-via-xmlhttprequest-fails/37512 "2020-09-24T18:49:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![daryashalima](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/daryashalima/32/26001_2.png) [@daryashalima](https://discuss.circleci.com/u/daryashalima)\
**Post date:** [September 24, 2020, 6:49pm UTC](https://discuss.circleci.com/t/post-requests-via-xmlhttprequest-fails/37512/1 "2020-09-24T18:49:03Z")

</div>

Hi all!

I’ve got an issue related to API v2.0.

I’m trying to send XMLHttpRequest (using axios) to API from browser.

GET requests with query parameters works fine.

Example:

const CIRCLE\_TOKEN: string = ‘\*\*\*’;  
const API\_URL: string = ‘[https://circleci.com/api/v2](https://circleci.com/api/v2)’;  
const PROJECT\_SLUG: string = '/gh/###/###;

```
        const fetchPipeline = async () => {
            const result = await axios({
                url: `${API_URL}/project${PROJECT_SLUG}/pipeline?circle-token=${CIRCLE_TOKEN}`,
                method: 'GET',
            });

            console.log(result);
        };

```

But for POST every request failed due to CORS policy

```
        const postPipeline = async () => {
            const result = await axios({
                url: `${API_URL}/project${PROJECT_SLUG}/pipeline`,
                method: 'POST',
                headers: {
                    'Access-Control-Allow-Origin': '*',
                    'Content-Type': 'application/json',
                    authorization: `Basic ${CIRCLE_TOKEN}`
                }
            });

            console.log(result);
        };

```

The error is following

Access to XMLHttpRequest at ‘[https://circleci.com/api/v2/project/gh/###/###/pipeline?circle-token=\*\*\*](https://circleci.com/api/v2/project/gh/###/###/pipeline?circle-token=***)’ from origin ‘localhost:3000’ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.

Could anyone help, is something wrong with request config?

---

<div class="post-metadata">

**Author:** ![yauhen](https://avatars.discourse-cdn.com/v4/letter/y/b4bc9f/32.png) [@yauhen](https://discuss.circleci.com/u/yauhen)\
**Post date:** [December 7, 2021, 5:47pm UTC](https://discuss.circleci.com/t/post-requests-via-xmlhttprequest-fails/37512/2 "2021-12-07T17:47:21Z")

</div>

Hey  
Have u solved this issue?

I found only one workaround: [https://cors-anywhere.herokuapp.com/](https://cors-anywhere.herokuapp.com/)

---

<div class="post-metadata">

**Author:** ![jlroot](https://avatars.discourse-cdn.com/v4/letter/j/57b2e6/32.png) [@jlroot](https://discuss.circleci.com/u/jlroot)\
**Post date:** [February 10, 2022, 3:44pm UTC](https://discuss.circleci.com/t/post-requests-via-xmlhttprequest-fails/37512/3 "2022-02-10T15:44:09Z")

</div>

I am looking for a response to this same issue.

My curl POST request works fine, but fetch returns a blocked by CORS policy.

Is it possible to whitelist a domain via CircleCI, or is there another workaround?

---

<div class="post-metadata">

**Author:** ![thaliaschulle99](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/thaliaschulle99/32/32568_2.png) [@thaliaschulle99](https://discuss.circleci.com/u/thaliaschulle99)\
**Post date:** [March 10, 2023, 10:28am UTC](https://discuss.circleci.com/t/post-requests-via-xmlhttprequest-fails/37512/4 "2023-03-10T10:28:29Z")

</div>

I have the same problem.