Question 1

What does 'idempotent' mean and why does it matter?

Accepted Answer

An idempotent method can be called multiple times with the same effect as one call. GET, PUT, DELETE are idempotent, `DELETE /users/1` succeeds the first time, returns 404 thereafter, but the state "user 1 doesn't exist" is the same after one or twenty calls. POST and PATCH are NOT idempotent, they create or modify in ways that compound. Idempotency matters for safe retries: network errors are common, retrying an idempotent call is harmless; retrying POST might create duplicates.

Question 2

Is PATCH idempotent?

Accepted Answer

By default, no, PATCH applies a delta, and applying the same delta repeatedly may compound (e.g., `{op: 'increment', path: '/count', value: 1}`). But PATCH CAN be designed idempotent: `{name: 'Alice'}` is fine to apply twice. RFC 5789 explicitly says PATCH is non-idempotent unless your server's semantics make it so. PUT is always idempotent because PUT means "replace with this exact representation."

Question 3

What's the difference between POST and PUT for creating?

Accepted Answer

**POST** to a collection (`POST /users`), server picks the ID, returns `201 Created` with the new URL in `Location: /users/123`. Use when you don't know or care about the resource's URL. **PUT** to a specific URL (`PUT /users/alice`), client picks the ID. Use when the client controls naming, like user-chosen handles or content-addressable URLs. POST = "make me one of these"; PUT = "this exact thing goes here."

Question 4

When should I use HEAD?

Accepted Answer

When you want headers without the body: check if a resource exists (200 vs 404), get its size from Content-Length, check freshness via ETag/Last-Modified, or verify content type. Common use: "is this URL still valid before I download a large file?" Browsers use HEAD internally for some cache validation. Many CDNs serve HEAD from cache without touching origin.

Question 5

What does OPTIONS do?

Accepted Answer

Two main uses: (1) **CORS preflight**, the browser sends OPTIONS before non-simple cross-origin requests, server replies with allowed methods/headers/origins. (2) **Capability discovery**, `OPTIONS /api/users` returns `Allow: GET, POST, OPTIONS` indicating which methods the resource supports. The first is automatic in browsers; the second is rarely used in practice.

Question 6

What's TRACE and is it safe?

Accepted Answer

TRACE echoes back the request as the server received it, useful for debugging proxies/intermediaries that might modify requests. Security caveat: TRACE can be used in cross-site tracing attacks if cookies are HttpOnly but the server echoes them in TRACE responses. Almost all production servers disable TRACE. RFC 9110 still defines it; the wider community treats it as deprecated.

Question 7

What's CONNECT used for?

Accepted Answer

CONNECT establishes a tunnel to a server through an HTTP proxy. The proxy connects to the target on the client's behalf and pipes bytes through. Main use: HTTPS through HTTP proxies, the proxy can't decrypt (no MITM cert), so it just tunnels. WebSocket upgrade also uses a CONNECT-like flow. End-user code rarely uses CONNECT directly; it's proxy infrastructure.

Question 8

What status codes match each method?

Accepted Answer

GET: 200 OK, 304 Not Modified (with conditional), 404 Not Found. POST: 201 Created (with `Location` header), 200 OK, 202 Accepted (async), 409 Conflict, 422 Unprocessable Entity. PUT: 200 OK or 204 No Content (modify), 201 Created (if PUT created). DELETE: 204 No Content (deleted), 404 (already gone). PATCH: 200 OK or 204. HEAD: same status as GET would return. OPTIONS: 204 typically.

Question 9

What standards does HTTP Methods Reference validate against?

Accepted Answer

HTTP Methods Reference checks compliance with RFC 3986 (URI), RFC 7231 (HTTP/1.1).

Question 10

What are the limitations of HTTP Methods Reference?

Accepted Answer

Network requests may be blocked by CORS policies. Does not bypass authentication or firewalls. Results depend on DNS propagation and network conditions.

Method	Safe	Idempotent	Cacheable	Request Body
`GET`	Yes	Yes	Yes	No
`POST`	No	No	Optionally	Yes
`PUT`	No	Yes	No	Yes
`PATCH`	No	No*	No	Yes
`DELETE`	No	Yes	No	Optionally

HTTP Methods Reference

Learn More

The Complete HTTP Status Code Cheatsheet (2026)

REST API Debugging Checklist: A Step-by-Step Guide

Ultimate JSON Guide: Everything a Developer Needs to Know

What is HTTP Methods Reference?

Frequently Asked Questions

Technical Deep Dive

HTTP Methods Reference

Built for Devs

Smart Defaults

Workflow-Friendly

01 Method Property Matrix

02 RESTful Resource Lifecycle

Runs 100% in your browser

You Might Also Need

Git Commit Message Generator

Regex Explainer

AI Code Review Assistant

API Client Code Generator