@mcoh - a CORS policy must be configured and added to an AEM Project that is - check in your project structure if any configuration file is there that must be named like: com.adobe.granite.cors.impl.CORSPolicyImpl~appname-graphql.cfg.json where appname reflects the name of your application. This is done by adding an appropriate OSGi CORS configuration file for the desired endpoint(s). Multiple CORS configurations can be created and deployed to different environments.
IFAIK, those configurations you can't find in CRXDE, best practice is as above suggested or to access them through system/console.
