It sounds like you have a little bit of confusion about how CORS works and when it is applicable, in particular because of this from your question:
Another question is whether there is any security issue in allowing
wildcard * all domains to access the API? I don't care if user uses
curl, or has his/her own script or has built custom UI for this API.
Why should I put restrictions?
The thing you have to keep in mind is that CORS and the pre-flight OPTION requests only matter for browsers. If someone is building their own API and using CURL or other server-to-server requests, there will never be a pre-flight request and any
Access-Control-Allow-Origin headers will be completely ignored.