The address lookup REST endpoints accept cross-site browser requests only when the request supplies a valid HTTP(S) Origin accepted by the Platform API's CORS policy. That policy includes Api.WhitelistedCorsHosts, configured Platform domains and root URLs; the host list is not restricted to a scheme or port. An installation's configured hosts can differ from the defaults.
Requests without cross-site Fetch Metadata retain their existing behavior. CORS and Fetch Metadata are browser protections, not authentication or rate limiting. Successful lookup operations use the installation's Location integration and enqueue metering events.