The API used to reflect any origin back in its CORS headers. It now only does that for first-party Examplary origins and an organization's own active custom domain.
If you were calling the API straight from browser JavaScript on your own domain, those requests will start failing. Server-to-server calls aren't affected — CORS is a browser-only restriction, so anything running on your backend carries on as before. If you need something in the browser, Embed Sessions are built for exactly that.
LTI, OAuth and the public endpoints stay open, since they're meant to be called from places we don't control.