HTTP Methods Cheatsheet - REST/HTTP Verbs & Idempotency

Both are temporary redirects, but 302 lets browsers rewrite POST into GET (many legacy implementations do), while 307 explicitly preserves the original method and body, so POST stays POST. 301 is permanent and typically coerces methods to GET; use 307 when you must keep POST semantics and payload.

PUT replaces the whole resource: the client sends the full representation and missing fields are treated as cleared, and it is idempotent so repeats give the same result. PATCH does a partial update with only changed fields but is not guaranteed idempotent. Use PATCH for incremental updates and PUT for full replacement or create.

The spec does not forbid it, but in practice it is unreliable — proxies, caches and CDNs often ignore or drop it, and GET is defined as side-effect-free and cacheable. Send complex queries via URL parameters, or switch to POST when data is large or structurally sensitive. Do not depend on a GET body.

Idempotent means repeating the same request any number of times leaves the server state identical, so retries are harmless. GET, PUT, DELETE, HEAD and OPTIONS are idempotent; POST is not, so resending it creates multiple resources. Only auto-retry idempotent requests, and dedupe POST with something like an idempotency key.

404 means the resource does not exist (wrong path or already gone); 405 means the resource exists but the method is unsupported (e.g. DELETE on a read-only resource) and should include an Allow header listing valid methods. Wrong paths give 404, wrong methods give 405; some APIs return 404 for both as a security boundary, but distinct codes ease integration.