External JSON CORS options

Hello,

I’m trying to expose some data from my API to use in the single/multi-option field types.

I don’t want to just open up CORS completely however, and the documentation doesn’t mention specifically what CORS settings are needed.

Which domains specifically do I need to open up for CORS?

Regards,
Nico