HTTP methods tell a server what action a client wants to perform on a resource. This can include retrieving a page, submitting data, replacing an object, modifying part of it, deleting it, or executing another type of request.
In early explanations, HTTP is often simplified as “GET reads, POST creates, PUT replaces, DELETE deletes.” While useful, this model is incomplete. POST may not create anything, PUT can create a resource, DELETE does not have to physically erase data, and PATCH does not prescribe a specific change mechanism.
The primary semantics of HTTP are described in RFC 9110. In addition to common methods, extensions exist for WebDAV, calendars, versioning, and other protocols. In June 2026, the new standardized QUERY method appeared, intended for complex requests that carry a body.
Safe and Idempotent Methods
Before examining individual methods, two key properties are important. A method is considered safe when it must not change the state of the resource at the client’s request. Safe methods include GET, HEAD, OPTIONS, TRACE, and QUERY.
Idempotent methods can be repeated multiple times with the same expected final effect as a single execution. GET, HEAD, PUT, DELETE, OPTIONS, TRACE, and QUERY are idempotent.
The following table summarizes the main methods and their properties:
- GET – retrieve a resource – safe: yes – idempotent: yes
- HEAD – retrieve headers without body – safe: yes – idempotent: yes
- POST – submit data for processing – safe: no – idempotent: no
- PUT – replace a resource – safe: no – idempotent: yes
- PATCH – partial modification – safe: no – idempotent: no
- DELETE – delete a resource – safe: no – idempotent: yes
- OPTIONS – retrieve resource capabilities – safe: yes – idempotent: yes
- TRACE – diagnose HTTP chain – safe: yes – idempotent: yes
- CONNECT – create a tunnel – safe: no – idempotent: no
- QUERY – safe request with body – safe: yes – idempotent: yes
GET is used to obtain a representation of a resource. Browsers load pages and images via GET, applications fetch API records, and search engines request results. Because it is safe and idempotent, caches and crawlers assume repeated calls will not alter application state.
HEAD is similar to GET but omits the response body. It is used when only metadata such as status, content type, size, or ETag is needed.
POST submits data to a resource for processing. It can create users or orders, submit forms, upload files, initiate payments, or start computations. POST is neither safe nor idempotent, so repeated requests may trigger duplicate operations.
PUT sends a complete new representation of a resource. It is idempotent and may also create a resource if none exists at the target URI.
PATCH, defined in RFC 5789, allows partial resource changes. Two common formats are JSON Merge Patch (RFC 7396) and JSON Patch (RFC 6902). Servers advertise supported formats via the Accept-Patch header.
DELETE requests removal of a resource. Implementations may physically delete data, mark it as deleted, or archive it. The method remains idempotent regardless of the internal storage approach.
OPTIONS queries the capabilities of a server or resource and is commonly seen in CORS preflight requests.
TRACE provides diagnostic information by returning the request as received by the server. It is rarely used in modern applications.
CONNECT establishes a tunnel through an HTTP intermediary, classically used for HTTPS via proxies.
The QUERY method, standardized in RFC 10008 in June 2026, enables safe requests that carry a body. It solves the problem of complex searches that previously had to be sent via POST, preserving correct semantics for caches and proxies. The Accept-Query header allows servers to declare supported content formats.
WebDAV and other extensions add further methods such as PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, and UNLOCK. Additional methods exist for calendaring and versioning. The IANA registry lists dozens of registered methods, demonstrating that HTTP continues to evolve.
