---
title: "Set the usage widget origins"
description: "Replaces the list of origins (scheme, host and port, for example https://app.example.com) allowed to call the widget from a browser."
canonical_url: "https://twominutebilling.com/help/developers/api-reference/usage-controls/set-the-usage-widget-origins"
---
# Set the usage widget origins

> Replaces the list of origins (scheme, host and port, for example https://app.example.com) allowed to call the widget from a browser.

<api-operation method="PUT" path="/v1/businesses/{biz}/settings/usage_widget">
<template v-slot:docs="">

Replaces the list of origins (scheme, host and port, for example `https://app.example.com`) allowed to call the widget from a browser. https only; plain http is accepted only from a loopback origin, for local testing. A request from an origin that is not on the list gets no CORS grant, so the browser does not show the data. At most 20.

## Path parameters

<table>
<thead>
  <tr>
    <th>
      Parameter
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Required
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        biz
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      <strong>
        yes
      </strong>
    </td>
    
    <td>
      The business's id (biz_…).
    </td>
  </tr>
</tbody>
</table>

## Headers

<table>
<thead>
  <tr>
    <th>
      Parameter
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Required
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        Idempotency-Key
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      no
    </td>
    
    <td>
      Safely retry writes — repeats return the original response. If a write FAILED after it had already taken effect, that failure is what repeats: the key is spent, and a new attempt needs a new key.
    </td>
  </tr>
</tbody>
</table>

## Body

The request body is **required**.

<table>
<thead>
  <tr>
    <th>
      Field
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Required
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        origins
      </code>
    </td>
    
    <td>
      <code>
        array of string
      </code>
    </td>
    
    <td>
      <strong>
        yes
      </strong>
    </td>
    
    <td>
      The usage widget settings's origins.
    </td>
  </tr>
</tbody>
</table>

## Response

<table>
<thead>
  <tr>
    <th>
      Field
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        object
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The object type; always <code>
        usage_widget_settings
      </code>
      
      . One of <code>
        usage_widget_settings
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        origins
      </code>
    </td>
    
    <td>
      <code>
        array of string
      </code>
    </td>
    
    <td>
      The usage widget settings's origins.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        script_url
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      Where the page loads <code>
        usage.js
      </code>
      
       from. Null when the API's public URL is not set.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        script_integrity
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The Subresource Integrity hash for the script tag's <code>
        integrity
      </code>
      
       attribute.
    </td>
  </tr>
</tbody>
</table>

## Status codes

<table>
<thead>
  <tr>
    <th>
      Status
    </th>
    
    <th>
      Meaning
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        200
      </code>
    </td>
    
    <td>
      The saved settings.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        400
      </code>
    </td>
    
    <td>
      An origin is not valid. <code>
        param
      </code>
      
       names it.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        409
      </code>
    </td>
    
    <td>
      Idempotency-Key conflict — the key is already in flight, or was reused with a different request payload.
    </td>
  </tr>
</tbody>
</table>
</template>

<template v-slot:request="">

```bash [Request]
curl -X PUT "$TMBILLING_URL/v1/businesses/biz_XXXXXXXXXXXX01/settings/usage_widget" \
  -H "Authorization: Bearer $TMBILLING_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "origins": [
      "Origin"
    ]
  }'
```

</template>

<template v-slot:response="">
<code-group>

```json [200 OK]
{
  "object": "usage_widget_settings",
  "origins": [
    "Origin"
  ],
  "script_url": "https://example.com/webhooks/billing",
  "script_integrity": "Script integrity"
}
```

```json [400 Bad Request]
{
  "error": {
    "type": "invalid_request_error",
    "message": "An origin is not valid."
  }
}
```

```json [409 Conflict]
{
  "error": {
    "type": "idempotency_error",
    "message": "Idempotency-Key conflict — the key is already in flight, or was reused with a different request payload."
  }
}
```

</code-group>
</template>
</api-operation>


## Sitemap

See the full [sitemap](https://twominutebilling.com/sitemap.md) for all pages.