---
title: "oz0 tenant cors"
description: "Usage and flags for oz0 tenant cors."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/tenant/cors"
---
# oz0 tenant cors

> Usage and flags for oz0 tenant cors.

For: Operators and developers looking up a command.

By default no page on another origin may read the tenant's job and feed events (GET /v1/jobs/{id}/events, GET /v1/feeds/{feed}/events) or ask for stream tickets: browsers refuse them, and the edge refuses the request. Each --allow-origin names one origin exactly as browsers send it (scheme, host, and port when it is not the default; https, or http on localhost for development; no path and no wildcard), and the list replaces the tenant's.

Such a page reads with a one-time stream ticket or an app's key, never a person's session: the answer never allows credentials. Allowing an origin widens who can read, so it takes --reason; --clear and removing origins do not. Admins of the tenant may change it; each change is audited (tenant.cors), and edges apply it within seconds.

## Usage

```bash
oz0 tenant cors <tenant> --allow-origin https://app.example.com [--allow-origin ...] --reason <why> | --clear [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --allow-origin
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      an origin whose pages may read the tenant's streams (repeat for more)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --clear
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      allow no other origin (the default)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --decision-ref
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the decision or case the change follows, such as a case number (at most 200 characters)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --reason
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      why, required for every change (default $OZ0_REASON); the audit log keeps it
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.