How to allow all the subdomain of my main domain for the API using CORS_WILDCARD?

### problem description

I want to allow only all of the subdomain of my main domain to access my API using CORS_WILDCARD. So please guide me How can I achieve this?
and if I add CORS_WILDCARD then also API is accessible from Postman. I want to disable API hit from postman also using CORS_WILDCARD.

### your instance configuration

_No response_