Cannot resolve CORS error after deleting the custom domain names created for the API M endpoints

[MahindraManoj]

I deployed an API M instance in internal vnet mode which will host all the endpoints inside my vnet. We have an app service that acts as the API M backend. I wanted to expose the api m gateway publicly using application gateway. As a part of that process, a custom domain name has been created for the gateway endpoint (of the api m) and used it as the fqdn for the backend pool of the app gateway. I configured the app gateway listener that will listen to the requests made to custom domain name of the api m gateway. We have a front end that is hosted by MS power apps which will access the api/app service that is behind the api M. 

I followed the steps mentioned in Integrating API Management with App Gateway V2 - Microsoft Tech Community

Yet, I couldn't access the endpoint publicly from my laptop with the host file entry to the custom domain name of the api m mapped to app gateway public ip.

In addition to it, we are seeing CORS error when our portal (that is on power apps) tries to load the api m despite the inbound policy for CORS has been set as mentioned below.

CORS error:::

Access to XMLHttpRequest at 'https://gt-dv-fileupload-api.azure-api.net/api/filemanager?path=d26c4b8d-6585-ec11-8d20-000d3ae92f2f... from origin 'https://gtca-dev-portal.powerappsportals.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Inbound policy:::

<cors>

            <allowed-origins>

                <origin>*</origin>

            </allowed-origins>

            <allowed-methods>

                <method>*</method>

            </allowed-methods>

            <allowed-headers>

                <header>*</header>

            </allowed-headers>

        </cors>

I deleted the custom domain name of the api m gateway, deleted the self signed certificate used in key vault, deleted the app gateway (without deleting the inbound rules/listeners one by one) and we still see the above cors error. Not sure how to deal with this. Appreciate the community's guidance and expertise.

[#2 · Accepted solution]

I found out the reason for this. When we create a custom domain name for developer portal of the API M, there is a setting/check-box that says enable CORS. When it is selected, it creates a global CORS policy (on all APIs) keeps the origin as the new custom domain name. It ignored the policy that has been applied on our specific api. After deleting the global cors policy, things started working fine.