Set up different CORS rules based on the endpoint in Django

django-cors-headers allows you to specify a custom handler function that will check if the request should be allowed. In your case you can use something like this:

# myapp/handlers.py
from corsheaders.signals import check_request_enabled

def cors_allow_particular_urls(sender, request, **kwargs):
    return request.path.startswith('/public-api/')

check_request_enabled.connect(cors_allow_mysites)

handlers.py needs to be loaded in app config:

# myapp/__init__.py

default_app_config = 'myapp.apps.MyAppConfig'

# myapp/apps.py

from django.apps import AppConfig

class MyAppConfig(AppConfig):
    name = 'myapp'

    def ready(self):
        # Makes sure all signal handlers are connected
        from myapp import handlers  # noqa

More info here: https://github.com/adamchainz/django-cors-headers#signals