When making a cross-origin request to the service, only the content-length and content-type headers are exposed. Tested with the service hosted at http://sysml2.intercax.com:9000/ . The Link header should be exposed to allow pagination. Appears that play.filters.cors.exposedHeaders is the appropriate option.