List allowed origins
Returns the CORS allowlist for the current store. Each entry is a
bare scheme://host[:port] permitted to call the admin API from a
browser. Backs the Rack::Cors allowlist and the CSRF boundary of
the admin cookie session (see
docs/plans/5.5-admin-auth-cookie-refresh.md).
Required scope: read_settings (for API-key authentication).
Authorizations
Secret API key for admin access
JWT token for admin user authentication
Headers
Bearer token for admin authentication
Query Parameters
Page number
Number of records per page
Filter by origin (contains)
Sort by field. Prefix with - for descending (e.g., -created_at).
Comma-separated list of fields to include. id is always included.

