HTTP Methods

HTTP methods (also called verbs) tell the server what action to perform on a resource.

GET

• Retrieve data from server.
• No request body.
• Idempotent — same request, same result.
• Safe — doesn't modify anything.
• Params sent in URL.

POST

• Create a new resource.
• Data sent in request body.
• Not idempotent — calling twice creates two resources.
• Not safe — modifies server state.

PUT

• Replace an existing resource completely.
• If resource doesn't exist → create it.
• Idempotent — calling multiple times = same result.
• Sends full resource in body.

PATCH

• Partially update a resource.
• Only sends fields to change (unlike PUT).
• Not necessarily idempotent.

DELETE

• Remove a resource.
• Idempotent — deleting twice = same result (already gone).

HEAD

• Same as GET but no response body.
• Used to check if resource exists, get metadata.
• Safe + Idempotent.

OPTIONS

• Returns allowed methods for a resource.
• Used in CORS preflight requests.
• Browser asks server: "What methods do you allow?"

TRACE

• Echoes back the received request.
• Used for diagnostic/debugging.
• Rarely used, often disabled (security risk).

CONNECT

• Establishes a tunnel through a proxy.
• Used for HTTPS through HTTP proxy.

Examples

GET /users/123 HTTP/1.1

POST /users HTTP/1.1
Body: { "name": "John", "email": "john@example.com" }

PUT /users/123 HTTP/1.1
Body: { "name": "John", "email": "new@example.com" }

PATCH /users/123 HTTP/1.1
Body: { "email": "new@example.com" }

DELETE /users/123 HTTP/1.1

HEAD /users/123 HTTP/1.1
→ Returns headers only, no body

OPTIONS /users HTTP/1.1
→ Allow: GET, POST, PUT, DELETE

CONNECT example.com:443 HTTP/1.1

All Methods at a Glance

Method	Action	Body	Idempotent	Safe
GET	Read	No	Yes	Yes
POST	Create	Yes	No	No
PUT	Replace	Yes	Yes	No
PATCH	Partial Update	Yes	No	No
DELETE	Delete	No	Yes	No
HEAD	Read headers	No	Yes	Yes
OPTIONS	Get allowed methods	No	Yes	Yes
TRACE	Diagnostic	No	Yes	Yes
CONNECT	Tunnel	No	No	No

Key Concepts

Idempotent — calling the method multiple times produces the same result. GET, PUT, DELETE, HEAD, OPTIONS are idempotent. POST is not.

Safe — method does not modify server state. GET, HEAD, OPTIONS are safe.

PUT vs PATCH

	PUT	PATCH
Updates	Entire resource	Partial resource
Missing fields	Set to null/default	Unchanged
Idempotent	Yes	Not necessarily
Bandwidth	Higher (full object)	Lower (partial)

Current: { name: "John", age: 25, city: "Delhi" }

PUT  → { name: "John", age: 26 }
Result: { name: "John", age: 26, city: null }  ← city lost!

PATCH → { age: 26 }
Result: { name: "John", age: 26, city: "Delhi" }  ← city kept!

POST vs PUT

	POST	PUT
URI	Collection /users	Specific resource /users/123
Action	Create new	Replace existing
Idempotent	No	Yes
Server assigns ID	Yes	No (client specifies)

CORS Preflight (OPTIONS)

1. Browser → OPTIONS /api/data (preflight)
2. Server → Allow: GET, POST / Allow-Origin: *
3. Browser → GET /api/data (actual request)