Gcp app engine flex endpoints openapi CORS

Having an error while trying to send OPTIONS to server. The error:

{
    "code": 7,
    "message": "The service does not allow CORS traffic.",
    "details": [
        {
            "@type": "type.googleapis.com/google.rpc.DebugInfo",
            "stackEntries": [],
            "detail": "service_control"
        }
    ]
}

I get a normal response if I send GET request (throught postman).

The node server uses KOA.js with cors enabled

app.use(cors());

it works without endpoints, so I don't think there could be a problem in server.

app.yaml

runtime: nodejs
env: flex

env_variables:
  NODE_ENV: "dev"

handlers:
- url: /
  static_dir: /
  http_headers:
    Access-Control-Allow-Origin: '*'

endpoints_api_service:
  name: ******.appspot.com
  rollout_strategy: managed

openapi-appengine.yaml

swagger: "2.0"
info:
  description: "A simple Google Cloud Endpoints API example."
  title: "Endpoints Example"
  version: "1.0.0"
host: "******.appspot.com"
x-google-endpoints:
- name: "******.appspot.com"
  allowCors: "true"
x-google-allow: all

paths:
  /api/user:
    get:
      operationId: "getcurrentuser"
      produces:
      - "application/json"
      parameters: []
      responses:
        200:
          description: "successful operation"
          schema:
            type: "object"
      security:
      - firebase: []

securityDefinitions:
  firebase:
    authorizationUrl: ""
    flow: "implicit"
    type: "oauth2"
    x-google-issuer: "https://securetoken.google.com/******"
    x-google-jwks_uri: "https://www.googleapis.com/service_accounts/v1/metadata/x509/securetoken@system.gserviceaccount.com"
    x-google-audiences: "******,******"