Hello, I'm facing the same issue. Did you figure out a solution?
I'm using https://{subdomain}.zendesk.com/api/v2/requests.json without authentication (allowing anonymous requests).

The call is from a regular web page, in javascript, in a similar way to the example above.

I also understand from the documentation that this issue should not happen.

https://developer.zendesk.com/documentation/ticketing/using-the-zendesk-api/making-cross-origin-browser-side-api-requests

Exceptions: A few Zendesk API endpoints don't require any authentication at all. They include the Create Request and Search Articles endpoints. CORS is implemented for these endpoints.

Thank you.