The Origin Allow-List of api.onepassapps.com: Two Allowed Origins, One Fixed Preflight and Per-Route Rate Limits

Measured from outside the browser: api.onepassapps.com answers access-control-allow-origin for exactly two origins, its preflight is a fixed 204 with eight allowed headers, and the rate limits differ by route.