| GET | Yes | Yes | Yes | No | Retrieve a representation of a resource. Must not change server state. |
|---|
| HEAD | Yes | Yes | Yes | No | Identical to GET but the response carries headers only — useful for checking size, type, or existence. |
|---|
| POST | No | No | Rarely | Yes | Submit data for the target resource to process. Repeating it may create duplicates; cacheable only with explicit freshness headers. |
|---|
| PUT | No | Yes | No | Yes | Replace the target resource entirely with the enclosed representation. Sending it twice leaves the same result. |
|---|
| DELETE | No | Yes | No | Optional | Remove the target resource. Idempotent: deleting twice ends in the same state, even if the second call returns 404. |
|---|
| CONNECT | No | No | No | No | Ask a proxy to open a TCP tunnel to the target — how HTTPS traffic passes through a forward proxy. |
|---|
| OPTIONS | Yes | Yes | No | Optional | Ask what the server supports for a resource. Browsers send it automatically as the CORS preflight. |
|---|
| TRACE | Yes | Yes | No | No | Echo the received request back for diagnostics. Usually disabled — it can leak headers via cross-site tracing. |
|---|
| PATCH | No | No | No | Yes | Apply a partial modification. Not idempotent in general, though a specific patch format can be. |
|---|