Javascript cors error: consume an ODataV4 Rest API "PATCH" endpoint with ntlm authentication

Question

I'm trying to consume an ODataV4 Rest Api to update the metadata of an invoice but I always end up with a cors error. Here is the code snippet thet I am using:

var data = JSON.stringify({"Status": "0- null"});
var xhttp = new XMLHttpRequest();
xhttp.open("PATCH", "https://mainURL/.../WS_Invoices('documentNumber')", true);
xhttp.withCredentials = true;
xhttp.setRequestHeader("If-Match" , "*");
xhttp.setRequestHeader("OData-MaxVersion", "4.0");
xhttp.setRequestHeader("OData-Version", "4.0");
xhttp.setRequestHeader("Accept", "application/json");
xhttp.setRequestHeader("Content-Type", "application/json; charset=utf-8");
xhttp.setRequestHeader("Prefer", "odata.include-annotations=\"*\"");
xhttp.send(data);
xhttp.onreadystatechange = function(){
if (xhttp.readyState === XMLHttpRequest.DONE) {
      if (xhttp.status === 200){
         console.log(xhttp.responseText);
      }
     else{
         console.log('There was a problem with the request.');
     }
}
};

PS: When I use the same code for the "GET" endpoint, it works perfectly.

PS: we are using NTLM authentication

PS: tha "PATCH" consuming works perfectly via postman