In the Apigee docs (and via the new auto-cors stuff when creating an
apiproxy) the recommendation is to put the AssignMessage for the CORS
headers in the Target - Preflow - Response.In the case of a 4xx error
coming from the backend, the Target Repso...