HTTP methods are request instructions that tell a web server what action a client wants to perform on a resource. They are part of the HTTP protocol and commonly tell an API whether to read, create, replace, update, or remove data. The method expresses intent, while the URL identifies the resource and the status code reports the result.
HTTP methods
What are HTTP methods?
HTTP methods are instructions in an HTTP request that tell a server what action a client wants on a resource. The method states intent, the URL identifies the resource, headers add context, an optional body carries data, and HTTP status codes report the result.
Common HTTP methods in REST APIs
REST APIs commonly use these conventions. A CRUD mapping is useful, but not mandatory.
| Method | Purpose | Example | CRUD |
|---|---|---|---|
| GET | Read data | Get a profile | Read |
| POST | Create or submit | Create an order | Create |
| PUT | Replace a resource | Replace a profile | Update |
| PATCH | Change part of a resource | Change an email | Update |
| DELETE | Remove a resource | Delete a draft | Delete |
| HEAD, OPTIONS | Inspect metadata or capabilities | Check allowed methods | None |
GET vs POST request
Choose GET for retrieval and POST for a state-changing submission.
| GET | POST | |
|---|---|---|
| Data location | Usually URL query | Usually request body |
| Caching | Often cacheable | Only when explicitly allowed |
| Example | Search products | Create an account |
URLs can be bookmarked and logged, so never place passwords or tokens in GET query strings.
How an HTTP request uses a method
- A client selects a URL and method.
- It sends headers and, when needed, a body.
- The server authenticates, validates, and performs the action.
- It returns a status code and response. For example, PATCH can update only a profile email.
Safe, idempotent, and cacheable methods
Safe means intended not to change server state. Idempotent means repeating the same request should have the same intended final effect. Cacheable means a response may be stored for reuse.
| Method | Key property | Retry note |
|---|---|---|
| GET | Safe and idempotent | Usually safe to retry |
| PUT, DELETE | Idempotent, but change state | Usually retryable |
| POST | Usually not idempotent | Use an idempotency key for payments or creates |
Practical limits and security considerations
Method names do not enforce security. The server must do so.
- Authorize every method, including DELETE and PATCH.
- Validate request bodies and reject unexpected fields.
- Avoid sensitive query values in GET requests.
- Disable TRACE unless there is a specific, reviewed need.
- Do not rely on a DELETE body, because support is inconsistent.
HTTP methods in Emergent
Apps built with Emergent can use HTTP methods when frontends call backend endpoints or third-party APIs. App design and development choices should define clear routes, methods, validation, and responses from the start. Build API-powered apps with Emergent.
Frequently Asked Questions
Your Questions, Answered
This will automatically populate, don't change
Don't change this element unless you know what you are doing
What are HTTP methods?
HTTP methods are request instructions, such as GET or POST, that tell a server the action a client intends to perform.
What are HTTP methods in a REST API?
In REST APIs, methods commonly express reading, creating, replacing, partially updating, or deleting a resource. These are conventions, not strict rules.
What is the difference between GET and POST?
GET retrieves data and commonly places parameters in the URL. POST submits data, usually in the request body, and commonly creates or triggers an action.
How many HTTP methods are there?
HTTP defines several standardized methods. Most web APIs mainly use GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS.
Can a DELETE HTTP method have a body?
A DELETE request can technically include a body, but support varies among clients, servers, and proxies. Put required identifiers in the URL when possible.
Start Building
on Emergent today
on Emergent today
Start Building
