What are the main HTTP methods used in REST APIs, and what is each one used for?

Question

Accepted Answer

REST APIs use HTTP methods, also called HTTP verbs, to indicate the type of action being performed on a resource. Understanding these methods is fundamental for API testing because each method has different behavior, different expectations for request and response bodies, and different implications for the server state.

GET is used to retrieve data from the server. It is a read-only operation that should not modify any data. For example, GET /api/users retrieves a list of users, and GET /api/users/123 retrieves the details of user 123. GET requests do not have a request body. The response typically contains the requested data in JSON format. GET requests should be idempotent, meaning making the same request multiple times produces the same result.

POST is used to create a new resource on the server. It sends data in the request body that the server uses to create the resource. For example, POST /api/users with a body containing name and email would create a new user. The response typically includes the created resource with its generated ID and a 201 Created status code. POST requests are not idempotent because sending the same request twice creates two separate resources.

PUT is used to update an existing resource by replacing it entirely. It sends the complete updated resource in the request body. For example, PUT /api/users/123 with a full user object replaces all fields of user 123. If a field is omitted from the request body, it may be set to null or its default value. PUT is idempotent because sending the same update multiple times results in the same final state.

PATCH is used to partially update a resource. Unlike PUT, you only send the fields that need to change. For example, PATCH /api/users/123 with just an email field updates only the email while leaving other fields unchanged. This is more efficient when you only need to modify one or two fields of a large resource.

DELETE is used to remove a resource from the server. For example, DELETE /api/users/123 removes user 123. The response typically returns a 200 OK or 204 No Content status. DELETE should be idempotent, meaning deleting the same resource twice should not cause an error on the second attempt.

When testing APIs, it is important to verify that each endpoint responds correctly to the appropriate HTTP method and returns an error for methods it does not support. For instance, a read-only resource should reject POST, PUT, and DELETE requests with a 405 Method Not Allowed status.