## Wildcards { #wildcards }

It's also possible to declare the list as `"*"` (a "wildcard") to say that all are allowed.

But that will only allow certain types of communication, excluding everything that involves credentials: Cookies, Authorization headers like those used with Bearer Tokens, etc.

So, for everything to work correctly, it's better to specify explicitly the allowed origins.

## Use `CORSMiddleware` { #use-corsmiddleware }

///

/// tip

Notice that in this case we are using a standard Python `open()` function that interacts with a file.

So, it involves I/O (input/output), that requires "waiting" for things to be written to disk.

But `open()` doesn't use `async` and `await`.

So, we declare the event handler function with standard `def` instead of `async def`.

 * UrlFilter, RuleManager, CrawlerContainer, IntervalController, and CrawlerClientFactory,
 * to perform its tasks.
 *
 * <p>The crawling process involves the following steps:
 * <ol>
 *   <li>Initialization: Sets up the crawler context and initializes the URL filter.</li>
 *   <li>Thread Creation: Creates a group of crawler threads to perform the actual crawling.</li>

 * and components from the Fess Crawler framework, such as {@link CrawlerContainer},
 * {@link UrlConvertHelper}, and {@link EncodingHelper}.
 * </p>
 * <p>
 * The transformation process involves:
 * </p>
 * <ol>
 *   <li>Determining the character set encoding of the HTML content.</li>
 *   <li>Storing the HTML content as data in the {@link ResultData}.</li>

    description: str
    paid: bool


class InvoiceEventReceived(BaseModel):
    ok: bool


invoices_callback_router = APIRouter()


@invoices_callback_router.post(
    "{$callback_url}/invoices/{$request.body.id}", response_model=InvoiceEventReceived
)
def invoice_notification(body: InvoiceEvent):
    pass  # pragma: nocover


class Event(BaseModel):
    name: str
    total: float

## An app with callbacks { #an-app-with-callbacks }

Let's see all this with an example.

Imagine you develop an app that allows creating invoices.

These invoices will have an `id`, `title` (optional), `customer`, and `total`.

The user of your API (an external developer) will create an invoice in your API with a POST request.

Then your API will (let's imagine):

    ok: bool


invoices_callback_router = APIRouter()


@invoices_callback_router.post(
    "{$callback_url}/invoices/{$request.body.id}", response_model=InvoiceEventReceived
)
def invoice_notification(body: InvoiceEvent):
    pass


@app.post("/invoices/", callbacks=invoices_callback_router.routes)
def create_invoice(invoice: Invoice, callback_url: Union[HttpUrl, None] = None):
    """

@pytest.fixture(name="client")
def get_client(mod: ModuleType):
    client = TestClient(mod.app)
    client.headers.clear()
    return client


def test_get(client: TestClient):
    response = client.post(
        "/invoices/", json={"id": "fooinvoice", "customer": "John", "total": 5.3}
    )
    assert response.status_code == 200, response.text
    assert response.json() == {"msg": "Invoice received"}

Nesse caso, é a `str`:

```Python
"{$callback_url}/invoices/{$request.body.id}"
```

Então, se o usuário da sua API (o desenvolvedor externo) enviar um request para *sua API* para:

```
https://yourapi.com/invoices/?callback_url=https://www.external.org/events
```

com um corpo JSON de:

```JSON
{
    "id": "2expen51ve",

    ok: bool


invoices_callback_router = APIRouter()


@invoices_callback_router.post(
    "{$callback_url}/invoices/{$request.body.id}", response_model=InvoiceEventReceived
)
def invoice_notification(body: InvoiceEvent):
    pass


@app.post("/invoices/", callbacks=invoices_callback_router.routes)
def create_invoice(invoice: Invoice, callback_url: HttpUrl | None = None):
    """
    Create an invoice.