CORS preflight request

OPTIONS

/wp-json/wp2tutor-bot/deepchat/v1/chat/{channel_id}

const url = 'https://example.com/wp-json/wp2tutor-bot/deepchat/v1/chat/123';
const options = {method: 'OPTIONS'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request OPTIONS \
  --url https://example.com/wp-json/wp2tutor-bot/deepchat/v1/chat/123

Browser widget preflight on the same path as POST. permission_callback is true; the secret is not checked. PHP reads channel_id from the path and does not validate the post: any numeric id returns 204. Headers: Access-Control-Allow-Origin (request Origin or *), Allow-Methods: POST, OPTIONS, Allow-Headers: Content-Type, X-Wp2tutor-Bot-Secret, Max-Age: 86400; if Origin is non-empty — Vary: Origin. No body.

Parameters

Path Parameters

channel_id

required

integer

Same path parameter as POST: channel post ID in the URL. Required because the route is /chat/(?P<channel_id>\d+). OPTIONS does not validate it (no 404 “channel not found”).

Example

Responses

204

Empty preflight response. CORS headers as in attach_cors_headers.

Headers

Access-Control-Allow-Origin

string

Request Origin, or * if the Origin header is empty.

Example

Access-Control-Allow-Methods

string

POST, OPTIONS.

Example

POST, OPTIONS

Access-Control-Allow-Headers

string

Content-Type and X-Wp2tutor-Bot-Secret (ChannelMeta::SECRET_HEADER).

Example

Content-Type, X-Wp2tutor-Bot-Secret

Access-Control-Max-Age

string

86400.