Where to edit the CORS Policy in Oracle Identity Manager?

I have an internal application team that is planning to use REST calls to create accounts and provision them with applications. They're running on Agile Apps, and as a result, are encountering some Cross Origin Resource Sharing errors when they submit requests.

I'm trying to find the location of the whitelist used to clear specific sites or domains. I can find the information for OAM, but this is using OIM endpoints.

I've tried finding this in Oracle's documentation, but I've come up empty.

I'm also fairly new in position and new to the admin side of Oracle, so I'm learning a lot about their steep learning curve.