Responses: JSON, String, Boolean, and Null

Use config responses for small, deterministic endpoints where a full proxy or service call adds no value. The `response` field in a path entry can be a JSON

Use config responses for small, deterministic endpoints where a full proxy or service call adds no value. The response field in a path entry can be a JSON object, string, boolean, or null. This page documents each type, how the gateway serializes it, and which content type header is returned.

Last reviewed: 2026-03-06

When to use this

Use the CORS and response reference when you need to control how the gateway handles browser cross-origin requests or what shape responses take for static, error, and operational endpoints. CORS is configured globally and applies to all routes unless overridden by an explicit OPTIONS handler.

Key concepts

• The CORS block is global -- it applies the same origin, method, and header policy to all routes. Per-route CORS overrides require explicit OPTIONS path entries.

• The gateway returns a 204 No Content response for OPTIONS preflight requests automatically. You only need an explicit OPTIONS route if a specific path requires different CORS headers.

• Static response routes can return JSON objects, strings, booleans, or null. The gateway serializes the response field as-is and sets Content-Type: application/json.

• Error responses follow a consistent JSON shape with error and message fields. 401 errors include details about which JWT check failed (expiry, issuer, audience).

• The gateway adds a powered-by response header by default. This can be useful for debugging which gateway version handled a request.

Repo-grounded example

{
  "$schema": "./api-config.schema.json",
  "title": "Minimal Gateway",
  "cors": {
    "allow_origins": ["https://app.example.com"],
    "allow_methods": ["GET", "POST", "OPTIONS"],
    "allow_headers": ["Content-Type", "Authorization"],
    "expose_headers": ["X-Request-Id"],
    "allow_credentials": true,
    "max_age": 300
  },
  "paths": [
    {
      "method": "GET",
      "path": "/health",
      "response": { "status": "ok" }
    }
  ]
}

This snippet returns {"status": "ok"} as the response body for the /health route. The gateway serializes the response field as JSON and sets Content-Type: application/json. You can also use a plain string, boolean, or null value.

Troubleshooting

• If the browser shows a CORS error, check that allow_origins includes the exact origin (scheme + domain + port) your frontend uses -- wildcards are not supported when allow_credentials is true.

• If preflight requests return 404 instead of 204, verify that the global CORS block is present in your config and that no explicit OPTIONS route is shadowing the default behavior.

• If a static response returns null as a string instead of JSON null, make sure the response field is set to null (no quotes) in the config JSON.

• If error responses do not include the expected message field, confirm you are testing against a current gateway version -- older versions used a different error shape.

Related docs

• cors

• introduction

• gateway troubleshooting matrix