HTTP methods

Client

Quick reference for common HTTP/1.1 request methods: typical safety (no server-side side effects intended), idempotency (repeating the request), and whether a message body is usual—pair with the status code list when debugging.

Reference

?

Values reflect typical HTTP/1.1 semantics (RFC 9110). APIs may impose stricter rules; always read your framework and server documentation.

9 methods

Try examples

MethodSafeIdempotentSummary
GETYesYesRetrieve a resource representation.Payload on GET is discouraged and may be ignored by intermediaries—use query parameters instead.Body: usually no
HEADYesYesSame as GET but without a response body (headers only).Body: usually no
POSTNoNoSubmit data to be processed (create actions, RPC-style calls).Body: usually yes
PUTNoYesReplace a resource at a known URI (full representation).Body: usually yes
PATCHNoNoApply partial changes to a resource.Idempotency depends on implementation; repeated PATCH may not be safe in all APIs.Body: usually yes
DELETENoYesRemove a resource.First DELETE may succeed; later DELETEs often return 404—still considered idempotent in effect.Body: optional
OPTIONSYesYesDescribe communication options for the target (often CORS preflight).Body: optional
TRACEYesYesEcho the received request (rare; often disabled).Security-sensitive; many proxies and servers disable TRACE.Body: usually no
CONNECTNoNoEstablish a tunnel (often HTTPS through HTTP proxy).Used for tunneling; not a typical REST CRUD verb.Body: optional

Common use cases

  • Check whether DELETE is considered idempotent before designing a retry policy.
  • Contrast GET vs HEAD when you only need headers or cache validation.
  • Read OPTIONS alongside status codes when debugging CORS preflight.

Common mistakes to avoid

  • Treating this table as a substitute for your API contract

    Frameworks may restrict bodies on certain verbs or add custom semantics—always read your API spec.

  • Assuming PATCH is always idempotent

    RFC semantics are not fully idempotent for PATCH; repeated calls may differ by implementation.

  • Sending sensitive data with GET

    URLs and query strings are logged broadly—use POST or another appropriate verb for secrets.

FAQ

Is this list sent to Toolcore?

No. Filtering and display run entirely in your browser.

Why does GET say “usually no” for a body?

HTTP does not forbid a body on GET, but intermediaries and caches often ignore or strip it—parameters belong in the URI.

Where do CONNECT and TRACE fit in REST APIs?

They are infrastructure or diagnostic methods—most REST CRUD designs use GET/POST/PUT/PATCH/DELETE only.

More tools

Related utilities you can open in another tab—mostly client-side.