Flowfuse cross domain settings (cor?)

Vendors FlowFuse
1

need a cross domain iframe
which I think is usually done via the settings.js

{
  "origin": "*",
  "methods": "GET,PUT,POST,DELETE",
  "optionsSuccessStatus": 204,
  "headers": {
    "Content-Security-Policy": "frame-ancestors 'self' https://example.com;"
  }
}

what is the method in flow fuse?