diff --git a/src/app.ts b/src/app.ts
index a62a1aa..2c4c02a 100644
--- a/src/app.ts
+++ b/src/app.ts
@@ -27,9 +27,9 @@ const CORS_CACHE_TTL_MS =
 app.use((req, res, next) => {
   // Check if this is a public API endpoint that should allow any origin
   const isPublicAPIEndpoint =
-    req.path.match(/^\/[^\/]+\/transfer-va\/(inquiry|payment)$/) ||
-    req.path.match(/^\/[^\/]+\/access-token\/b2b$/) ||
-    req.path.match(/^\/[^\/]+\/utilities\/signature-service$/);
+    req.path.match(/^\/api\/[^\/]+\/transfer-va\/(inquiry|payment)$/) ||
+    req.path.match(/^\/api\/[^\/]+\/access-token\/b2b$/) ||
+    req.path.match(/^\/api\/[^\/]+\/utilities\/signature-service$/);
   if (isPublicAPIEndpoint) {
     // Allow any origin for public API endpoints
     const publicCorsOptions = {