CORS issue when deployed UiPath Coded App calls Orchestrator REST API directly

Help Apps
1

I am working on a UiPath Coded App using the TypeScript SDK. The app is deployed successfully on UiPath Automation Cloud, and authentication with UiPath is working.

The app is designed as a QA console. From the UI, I am calling UiPath Orchestrator REST APIs to find folders, releases, and start jobs for UiPath Coded Agents.

Locally, everything works fine because I am using the Vite dev server proxy:

Current status:

  • UiPath Coded App deployment is successful.
  • Authentication is working.
  • External Application redirect URL is configured.
  • Bearer token is present in the request.
  • The same API flow works locally through Vite proxy.
  • The deployed app fails only because the browser blocks the cross-origin Orchestrator API call.

My questions:

  1. Is direct browser-to-Orchestrator REST API calling supported from a deployed UiPath Coded App?
  2. Is there any UiPath-supported configuration to allow the deployed Coded App origin to call Orchestrator APIs?
  3. Should this be implemented through a UiPath API Workflow / backend wrapper instead of calling Orchestrator REST APIs directly from the Coded App?
  4. For a production-ready Coded App, what is the recommended approach to start Orchestrator jobs or trigger Coded Agents from the UI?
2
  1. From the docs, Coded Apps are static sites hosted at https://.uipath.host/ and Orchestrator APIs are under api.uipath.com / tenant URLs.
  • Cross-origin browser calls are only explicitly documented for API triggers, where you must configure a CORS allow list for API triggers in tenant settings so browser apps can call Orchestrator without CORS errors.
  • Outside of that API‑triggers surface, CORS is not documented as generally open, so you should not rely on arbitrary browser‑to‑Orchestrator calls working in production.
  1. For API Triggers, yes: add your Coded App origin (for example https://.uipath.host) to Tenant Settings → General → CORS allow list for API triggers so browser apps can call those trigger endpoints. (Orchestrator - Managing API triggers).
  • There is no broader CORS configuration documented for all Orchestrator REST APIs.
  1. For production, the safer, supported pattern is:
  • Expose API Triggers or other backend endpoints (e.g., coded agents / processes) that run server-side.
  • From the Coded App UI, call those trigger endpoints (with CORS allowlisted), not the full Orchestrator REST surface directly.
  1. Use the UiPath TypeScript SDK from your coded app to interact with UiPath resources where possible.
  • For starting jobs / coded agents in a production-ready way:
    • Create Orchestrator API Triggers or processes that encapsulate “start job / coded agent”.
    • Allowlist your app origin in CORS allow list for API triggers.
    • Call those triggers from the Coded App UI instead of raw Orchestrator REST endpoints.