What's the difference between PUT and PATCH?

PUT replaces the whole resource; the body should contain the complete new state. PATCH updates only the fields you specify (partial update). PUT is idempotent (same payload, same result); PATCH is typically idempotent but not required to be.

When should I use POST vs PUT for creation?

POST when the server assigns the ID (create a new user, server returns the generated user ID). PUT when the client specifies the ID (overwrite document at /users/42 with this content).

Is DELETE idempotent?

Yes — calling DELETE twice on the same resource has the same effect as calling it once. The second call typically returns 404 instead of 204, but the resource state is the same either way.

rest · safe · idempotent · body · cache

Every HTTP method — semantics at a glance

Q: Is anything sent to a server?

No — this is a static reference page.

GET, POST, PUT, PATCH, DELETE and friends — with safety, idempotency, body and cache semantics. Static reference, no network needed.

HTTP Methods Reference

Total

verbs

Safe

no side effects

Idempotent

repeatable

Visible

all

catalog · methods

summary · properties

Safe: no observable side effects. Read-only.

Idempotent: repeating produces the same effect on the server.

Body: whether the method conventionally carries a request body.

Cacheable: whether responses are cacheable by default.

Click any row to copy the method name.

Quick Start

How to pick the right HTTP method

Match intent to verb: read vs write, replace vs patch, safe vs unsafe.

01
Reading?
Use GET for representations, HEAD for existence-only checks.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
readIANAregistryofflinelive
verb · queryGET · IANA
```
GET /users/42
```
loaded · IANA bundlespec · ready
02
Writing?
POST creates, PUT replaces, PATCH updates fields, DELETE removes.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
writeRFC 9110canonicalspec-compliantlive
verb · optionsPUT · live
```
PUT /users/42
```
options applied · livecanonical
03
Cross-origin?
Non-simple requests trigger an OPTIONS preflight first.
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
corsvalidationlintpitfallslive
verb · looked upOPTIONS · ready
```
OPTIONS /api/x → 204
```
result · livevalidated
04
Retry policy
Only retry idempotent verbs automatically — GET/PUT/DELETE are safe with backoff.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
retryclipboardMIME-correctblobcurl-ready
ok · copiedready · done
```
retry on 502/503/504
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to consult this reference

API design, code review, onboarding.

API design

Pick the right verb the first time. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Code review

Catch POST-misuse where PUT or PATCH would do. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Idempotency keys

Decide which verbs need them in your protocol. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Client SDKs

Document method semantics for downstream consumers. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Onboarding

One-page cheatsheet for new engineers. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

OpenAPI specs

Pair with the spec when documenting endpoints. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

Is POST really not idempotent?

By default no. You can make it idempotent at the protocol level with an Idempotency-Key header, but the verb itself doesn't promise it.

Can GET have a body?

Spec-wise yes, but most intermediaries ignore or strip it. Don't rely on it.

What about PURGE / LINK / etc?

Non-standard. Used by some CDNs and old extensions; not part of HTTP/1.1.

Why does OPTIONS exist?

To describe communication options for a target, and crucially for CORS preflights.

Is anything sent to a server?

No — this page is a static reference that runs locally.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!