Enhance CORS management by supporting regular expressions for allowed origins and enabling CORS policy definition at the Catalog level, allowing immutable API definitions across environments.

The Catalog Properties feature enables customers to maintain a single, immutable YAML file for an API definition, independently of the environment in which the API is deployed. This is a key capability to support modern DevOps and CI/CD practices.

However, when CORS policies are explicitly defined at the API level, allowed origins must currently be specified as fixed string values. Since allowed origins are inherently environment-dependent, this forces customers to customize the API definition for each environment. For example, an API running in a development environment may require https://dev.example.com as an allowed origin, while the same API in production requires https://example.com.

As a result, it is currently not possible to define a CORS policy in a truly environment-independent way. The only workaround is to define a superset of all allowed origins for all environments in a single API definition. This approach leads to configurations that are harder to read and maintain, mixes environment-specific information in all deployments, and may expose production-related settings in non-production environments, which is not considered a best practice from a governance and security perspective.

Allowing the use of regular expressions for allowed origins would address this limitation. For example, a pattern such as https://.*example.com (or ^https://.*example\.com$) would match both development and production origins, enabling a single, immutable API definition to be reused across all environments.

As a complementary (or alternative) enhancement, enabling CORS policies to be defined at the Catalog level would further improve flexibility. Since catalogs already represent different execution environments, this would allow environment-specific CORS configurations while keeping API definitions fully immutable and portable.

These enhancements would significantly improve API lifecycle management, DevOps automation, configuration clarity, and governance for enterprise customers using IBM API Connect.