restAPI per cross-domain-scripting not possbile

CMK version: Checkmk Enterprise Edition 2.2.0p9
OS version: virt-application 1.6.3

Problem:
I want to acknowledge service- and hoststates via restAPI from our Ticketsystem with cross-domain-scripting by browser. But i always get errormessage in scriptingconsole

Access to XMLHttpRequest at ‘https://checkmserver/sitename/check_mk/api/1.0/domain-types/acknowledge/collections/service’ from origin ‘https://ticketserver’ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.

Where in apache-configuration i have to configure the header-option

Header add Access-Control-Allow-Origin “https://checkmserver

to allow Cross-Domain-Scripting. I tried a couple of places in directory ~/etc/apache/conf.d. But no one seems to have an impact to the preflight-request from the browser. But it must be specific to restAPI. on other pages i can see the impact of modfied configuration.