GET, POST, PUT, and DELETE: the four main REST API methods explained

GET, POST, PUT, and DELETE are the four HTTP methods most often used to implement CRUD operations, read, create, update, and delete, in a REST API. RFC 9110, the current HTTP Semantics specification, formally defines eight standard request methods, and these four cover the basic operations a REST client performs against a resource.

What does each method do?

What does idempotency mean for how you use them?

Idempotent means sending the same request multiple times produces the same server state as sending it once. A client can safely retry a GET, PUT, or DELETE call after a network timeout without worrying about duplicate side effects. POST carries no such guarantee: resending a POST that creates an order or charges a card can create a second order or a second charge, which is why retry logic and idempotency keys are built specifically around POST endpoints.

Where does PATCH fit into this?

"Four main methods" is a simplification. HTTP also defines PATCH, specified separately in RFC 5789, for partial updates: a PATCH request sends only the fields that changed instead of the full resource representation that PUT requires. Unlike PUT, PATCH is not guaranteed idempotent, since a partial operation such as incrementing a counter produces a different result each time it repeats.

What status codes typically pair with each method?

A successful POST that creates a resource commonly returns 201 Created along with a Location header pointing to the new resource. GET, PUT, and DELETE typically return 200 OK or 204 No Content when there is no response body to send. A request that uses a method the server does not support on that route returns 405 Method Not Allowed, and GET is the only one of the four also classified as "safe" under the HTTP spec, meaning it is not expected to change server state at all.

Updated: 2026-07-20