3446644 - CORS and Access-Control-Allow-Origin issue when calling BTP workzone notification odata service notification_srv

Fiori notification does not work by clicking notification icon.

Trace shows it is calling BTP workzone notification odata service notification_srv failed, and error like:

http trace:

Request URL:
https://clm-sl-ans-live-ans-service-api.cfapps.jp10.hana.ondemand.com/sap/opu/odata4/iwngw/notification/default/iwngw/notification_srv/0001//Notifications?$expand=Actions,NavigationTargetParams&$orderby=CreatedAt%20desc&$filter=IsGroupHeader%20eq%20false&$skip=0&$top=21
Request Method:
OPTIONS
Status Code:
403 Forbidden

http control trace:

 GET https://clm-sl-ans-live-ans-service-api.cfapps.jp10.hana.ondemand.com/sap/o…rderby=CreatedAt%20desc&$filter=IsGroupHeader%20eq%20false&$skip=0&$top=21 net::ERR_FAILED
:/sap/bc/ui2/fl…age=EN#Shell-home:1 Access to XMLHttpRequest at 'https://clm-sl-ans-live-ans-service-api.cfapps.jp10.hana.ondemand.com/sap/o…4/iwngw/notification/default/iwngw/notification_srv/0001//ResetBadgeNumber' from origin 'https://XXXXXXXXXXXXX' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
common.load.xhrlogon-dbg.js:375 Uncaught TypeError: Cannot read properties of undefined (reading 'toLowerCase')
    at a._csrfTokenInvalid (Notifications-dbg.js:1891:55)
    at Notifications-dbg.js:1042:30
    at XMLHttpRequest.y [as _onreadystatechange] (datajs-dbg.js:2548:25)
    at a (common.load.xhrlogon-dbg.js:365:22)
    at r.dispatch (common.load.xhrlogon-dbg.js:453:13)
    at a.handleEvent (common.load.xhrlogon-dbg.js:2836:29)
    at XMLHttpRequest.t [as _fnHandler] (common.load.xhrlogon-dbg.js:2858:22)
common.load.xhrlogon-dbg.js:3066 

BTP 

"An error has occurred", Access-Control-Allow-Origin,  CORS  , KBA , OPU-GW-NOT , Notification , CA-FLP-ABA , SAP Fiori Launchpad ABAP Services , Problem