HTTP request methods explained
HTTP defines nine standard request methods, but most everyday traffic uses only a few of them. This table explains each method, whether it is safe and idempotent, and the status codes a successful call returns.
| Method | Purpose | Safe? | Idempotent? | Success status |
|---|---|---|---|---|
| GET | Retrieve a resource | Yes | Yes | 200 OK |
| HEAD | Retrieve headers only, no body | Yes | Yes | 200 OK |
| POST | Create a resource or trigger an action | No | No | 201 Created |
| PUT | Replace a resource entirely | No | Yes | 200 OK / 204 No Content |
| PATCH | Apply a partial update | No | No | 200 OK |
| DELETE | Remove a resource | No | Yes | 200 OK / 204 No Content |
| OPTIONS | CORS preflight; list allowed methods | Yes | Yes | 204 / 200 OK |
| TRACE | Echo the request back for diagnostics | Yes | Yes | 200 OK |
| CONNECT | Open a tunnel, e.g. HTTPS via a proxy | No | No | 200 OK |
Notes
- Safe means the method never changes server state: GET, HEAD, OPTIONS and TRACE are the only safe methods.
- Idempotent means repeating the call gives the same outcome as one call: PUT, DELETE and GET qualify; POST and PATCH do not.
- When a route does not accept a method, the server replies 405 Method Not Allowed and usually includes an Allow header.
Frequently asked questions
- What is the difference between GET and POST?
- GET retrieves a resource without side effects and can be repeated safely; parameters travel in the URL. POST creates something or triggers an action, may change state, and should not be repeated blindly.
- What does it mean for an HTTP method to be safe?
- A safe method never modifies server state, so it can be called without risk. GET, HEAD, OPTIONS and TRACE are safe; POST, PUT, PATCH and DELETE are not.
- What is the difference between PUT and PATCH?
- PUT replaces the whole resource with what you send; PATCH applies a partial change to selected fields. PUT is idempotent, so repeating it gives the same result; PATCH generally is not.
- What does the HEAD method do?
- HEAD behaves like GET but returns no response body. It is useful for checking whether a resource exists, its size or headers, without downloading the whole content.