@JananiRamesh-MSFT and Marko Illic, I did want to mention that I've created an API Management in a VNET and exposed it via an application gateway and used a self-signed certificate for the HTTPS aspect.
on the developer portal, the "Try It" function was saying that I must enable CORS which I'd done but when I opened up Edge browser's developer console I saw that even though I'd trusted the self-signed certificate on portal.customdomain.com (developer portal) I had not done so on api.customdomain.com (the api gateway) and so chrome was showing CERTIFICATE_INVALID error and it was only the developer console's UI that was saying it was a CORS error. once I navigated to https://api.customdomain.com and told the browser to proceed to the "unsafe" site.. then the developer interactive portal worked properly.