Title: rest_exposed_cors_headers
Published: August 11, 2020
Last modified: May 20, 2026

---

# apply_filters( ‘rest_exposed_cors_headers’, string[] $expose_headers, WP_REST_Request $request )

## In this article

 * [Parameters](https://developer.wordpress.org/reference/hooks/rest_exposed_cors_headers/?output_format=md#parameters)
 * [Source](https://developer.wordpress.org/reference/hooks/rest_exposed_cors_headers/?output_format=md#source)
 * [Related](https://developer.wordpress.org/reference/hooks/rest_exposed_cors_headers/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/hooks/rest_exposed_cors_headers/?output_format=md#changelog)

[ Back to top](https://developer.wordpress.org/reference/hooks/rest_exposed_cors_headers/?output_format=md#wp--skip-link--target)

Filters the list of response headers that are exposed to REST API CORS requests.

## 󠀁[Parameters](https://developer.wordpress.org/reference/hooks/rest_exposed_cors_headers/?output_format=md#parameters)󠁿

 `$expose_headers`string[]

The list of response headers to expose.

`$request`[WP_REST_Request](https://developer.wordpress.org/reference/classes/wp_rest_request/)

The request in context.

## 󠀁[Source](https://developer.wordpress.org/reference/hooks/rest_exposed_cors_headers/?output_format=md#source)󠁿

    ```php
    $expose_headers = apply_filters( 'rest_exposed_cors_headers', $expose_headers, $request );
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/rest-api/class-wp-rest-server.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.0/src/wp-includes/rest-api/class-wp-rest-server.php#L402)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.0/src/wp-includes/rest-api/class-wp-rest-server.php#L402-L402)

## 󠀁[Related](https://developer.wordpress.org/reference/hooks/rest_exposed_cors_headers/?output_format=md#related)󠁿

| Used by | Description | 
| [WP_REST_Server::serve_request()](https://developer.wordpress.org/reference/classes/wp_rest_server/serve_request/)`wp-includes/rest-api/class-wp-rest-server.php` |

Handles serving a REST API request.

  |

## 󠀁[Changelog](https://developer.wordpress.org/reference/hooks/rest_exposed_cors_headers/?output_format=md#changelog)󠁿

| Version | Description | 
| [6.3.0](https://developer.wordpress.org/reference/since/6.3.0/) | The `$request` parameter was added. | 
| [5.5.0](https://developer.wordpress.org/reference/since/5.5.0/) | Introduced. |

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Fhooks%2Frest_exposed_cors_headers%2F)
before being able to contribute a note or feedback.