Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin'?

Question

CORS

What kind of magic is this?
I make an ajax request to the server, I get an error

XMLHttpRequest cannot load https://site.com/api. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost' is therefore not allowed access.

Moreover, if you write

xhr.open('POST', 'https://site.com/api', true);
xhr.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
xhr.send('entityId='+params);

Then there is no error, and if so

xhr.open('POST', 'https://site.com/api', true);
xhr.setRequestHeader("Content-Type", "application/json;charset=UTF-8");
xhr.send(params);

I.e.
Through a normal post request everything works. The server returns the Access-Control-Allow-Origin * header.
What am I doing wrong?