AJAX seems to be unable to GET AWS API Gateway even with CORS enabled
<p>I have made an API Gateway which calls a lambda function on AWS.  The link to GET it is:</p>

<p><a href="https://z4eiy7g9n0.execute-api.us-east-1.amazonaws.com/test/rotation" rel="nofollow noreferrer">https://z4eiy7g9n0.execute-api.us-east-1.amazonaws.com/test/rotation</a></p>

<p>Clicking it should return a number bigger than 6000.  I want to use Javascript to GET the API and my understanding is I need to use AJAX to do that.  So, I have the following javascript (importing jQuery 3.1.1):</p>

<pre><code>$(document).ready(function(){
    $("button").click(function(){
        $.ajax({
         url: "https://z4eiy7g9n0.execute-api.us-east-1.amazonaws.com/test/rotation",
         headers: {"Content-Type": "text/json"},
         type: "GET",
         success: function() { alert('Success!'); }
      });
    });
});
</code></pre>

<p>This doesn't work because of cross-origin stuff and so my understanding is I need to enable CORS.  So, I followed the instructions in <a href="http://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-cors.html" rel="nofollow noreferrer">http://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-cors.html</a>.  I have</p>

<pre><code>Access-Control-Allow-Origin*: '*'
Access-Control-Allow-Headers: 'Content-Type'
</code></pre>

<p>My understanding of this is that the origin can be any domain and the only header that needs to be included is 'Content-Type'.  However, when I click my button to trigger this event, I get the following error in my console.</p>

<blockquote>
  <p>XMLHttpRequest cannot load
  <a href="https://z4eiy7g9n0.execute-api.us-east-1.amazonaws.com/test/rotation" rel="nofollow noreferrer">https://z4eiy7g9n0.execute-api.us-east-1.amazonaws.com/test/rotation</a>.
  Response to preflight request doesn't pass access control check: No
  'Access-Control-Allow-Origin' header is present on the requested
  resource. Origin 'http://****' is therefore not allowed access. The
  response had HTTP status code 403.</p>
</blockquote>

<p>Now, I can call the API from R using the <code>httr</code> package, so I know it can be called from at least some systems.</p>

<p>What am I doing wrong with either my AJAX request or with my API?</p>