An option in API Developer Portal (4.2 and 3.5), when setting up the API to specify that the service need CORS support. And that this support is then pushed to the Gateway, so the service then can handle OPTIONS requests as well as the GET/POST/PUSH request of the service.
It is not always clear if an OPTIONS request is going to be sent. But browsers can upgrade a normal GET request to one that makes an OPTIONS request before the GET/POST/PUSH request. It does this when the request does not fall into the "simple" category. Cross-origin resource sharing - Wikiwand
Processing OPTIONS calls can be tricky, where for the same API code, some clients (browsers) will send a CORS OPTIONS request, whereas other clients (curl, httpclient) wil not send the OPTIONS request As per :
TechTip : When you need API Gateway Service to respond to both CORS and not CORS requests
So it would be good to have the CORS support built into API Developer Portal.
Cheers - Mark