CORS is browser-enforced and protects users, not APIs. curl, Postman, and servers ignore it entirely. It governs which pages' JS may read responses, it was never a lock on your endpoint's door.