HTTP Methods Explained: GET, POST, PUT, PATCH, DELETE and the New QUERY Standard
HTTP methods tell a server what action a client wants to perform on a resource. This can include retrieving a page, submitting data, replacing an object, modifying part of it, deleting it, or executing another type of request.
In early explanations, HTTP is often simplified as “GET reads, POST creates, PUT replaces, DELETE deletes.” While useful, this model is incomplete. POST may not create anything, PUT can create a resource, DELETE does not have to physically erase data, and PATCH does not prescribe a specific change mechanism.
The primary semantics of HTTP are described in RFC 9110. In addition to common methods, extensions exist for WebDAV, calendars, versioning, and other protocols. In June 2026, the new standardized QUERY method appeared, intended for complex requests that carry a body.
Safe and Idempotent Methods
Before examining individual methods, two key properties are important. A method is considered safe when it must not change the state of the resource at the client’s request. Safe methods include GET, HEAD, OPTIONS, TRACE, and QUERY.
Idempotent methods can be repeated multiple times with the same expected final effect as a single execution. GET, HEAD, PUT, DELETE, OPTIONS, TRACE, and QUERY are idempotent.
The following table summarizes the main methods and their properties:
- GET – retrieve a resource – safe: yes – idempotent: yes
- HEAD – retrieve headers without body – safe: yes – idempotent: yes
- POST – submit data for processing – safe: no – idempotent: no
- PUT – replace a resource – safe: no – idempotent: yes
- PATCH – partial modification – safe: no – idempotent: no
- DELETE – delete a resource – safe: no – idempotent: yes
- OPTIONS – retrieve resource capabilities – safe: yes – idempotent: yes
- TRACE – diagnose HTTP chain – safe: yes – idempotent: yes
- CONNECT – create a tunnel – safe: no – idempotent: no
- QUERY – safe request with body – safe: yes – idempotent: yes
GET is used to obtain a representation of a resource. Browsers load pages and images via GET, applications fetch API records, and search engines request results. Because it is safe and idempotent, caches and crawlers assume repeated calls will not alter application state.
HEAD is similar to GET but omits the response body. It is used when only metadata such as status, content type, size, or ETag is needed.
POST submits data to a resource for processing. It can create users or orders, submit forms, upload files, initiate payments, or start computations. POST is neither safe nor idempotent, so repeated requests may trigger duplicate operations.
PUT sends a complete new representation of a resource. It is idempotent and may also create a resource if none exists at the target URI.
PATCH, defined in RFC 5789, allows partial resource changes. Two common formats are JSON Merge Patch (RFC 7396) and JSON Patch (RFC 6902). Servers advertise supported formats via the Accept-Patch header.
DELETE requests removal of a resource. Implementations may physically delete data, mark it as deleted, or archive it. The method remains idempotent regardless of the internal storage approach.
OPTIONS queries the capabilities of a server or resource and is commonly seen in CORS preflight requests.
TRACE provides diagnostic information by returning the request as received by the server. It is rarely used in modern applications.
CONNECT establishes a tunnel through an HTTP intermediary, classically used for HTTPS via proxies.
The QUERY method, standardized in RFC 10008 in June 2026, enables safe requests that carry a body. It solves the problem of complex searches that previously had to be sent via POST, preserving correct semantics for caches and proxies. The Accept-Query header allows servers to declare supported content formats.
WebDAV and other extensions add further methods such as PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, and UNLOCK. Additional methods exist for calendaring and versioning. The IANA registry lists dozens of registered methods, demonstrating that HTTP continues to evolve.
Related articles
Microsoft 365 Admin Tool Exposes Pitfalls in Graph, Exchange PowerShell and Intune Management
An open-source developer has released version 2.0 of SwissKnife for MS Graph, a tool that adds a safe preview-and-apply layer on top of Microsoft 365 administration. The project addresses the lack of a native what-if mode in Microsoft Graph and the incomplete coverage of Exchange tasks in the Graph API. It implements a two-step plan-and-apply workflow, supports fallback to Exchange Online PowerShell or the Admin API, and runs community scripts under strict constraints. The author details multiple real-world obstacles including named-location ID drift in Conditional Access policies, masked secrets returned by Intune, and limitations when restoring Transport Rules from snapshots. The tool also provides a worker mode for macOS and Linux users and enforces script signing plus AST-based command whitelisting. Feedback is requested on error messages and tasks that still require manual PowerShell use.
Neuromorphic Processors Lag Behind GPUs for Large AI Models Despite Energy Advantages
Neuromorphic chips such as Intel Loihi promise major energy savings by activating only when events occur, yet data centers remain dominated by GPUs optimized for dense matrix operations in generative AI. The mismatch arises because modern large language models rely on high-precision linear algebra, massive memory bandwidth, and mature software stacks that neuromorphic architectures currently lack. Researchers are exploring spiking transformers and on-chip plasticity via mechanisms like STDP, but scaling to billions of parameters remains challenging. Companies including BrainChip, SynSense, and SpiNNaker2 have released commercial neuromorphic hardware, yet the absence of standardized tools and clear performance gains for mainstream workloads slows adoption. Hybrid approaches combining neuromorphic blocks with in-memory computing, analog circuits, and photonic accelerators may define future heterogeneous systems rather than outright replacement of GPUs.
Russia Expands Digital Birth Certificates via MAX App for Transport, Healthcare and Public Services
The Russian government has broadened the list of situations where parents can use the electronic version of a child’s birth certificate stored in the Digital ID section of the MAX service. The digital document can now be presented when buying transport tickets, claiming free or discounted travel, boarding public transport, receiving medical care under OMS, visiting MFC offices, museums, cultural and sports events, and purchasing discounted tickets. The measure also covers any other services requiring proof of a minor’s identity. Use of the QR code remains voluntary, and the paper certificate continues to be valid. The service activates gradually as organizations connect their systems, with more than 3,000 hotels already integrated.
PT AF Cloud Uses Machine Learning to Detect Shifts in Web Attack Patterns from Millions of WAF Events
Positive Technologies has detailed how its PT AF Cloud service applies anomaly detection to WAF events, turning tens of millions of daily security events into actionable weekly alerts for SOC teams. The system builds traffic profiles based on the distribution of triggered protection rules for each tenant and compares current hourly or daily profiles against a weighted historical baseline using Jensen-Shannon distance. This approach identifies meaningful changes in attack composition even when overall event volume remains stable, catching the start of scans, exploitation of newly published vulnerabilities, or post-release application changes that trigger new rules. Two detection modes operate in parallel: an hourly mode for rapid spikes and a daily mode for gradual shifts distributed across multiple hours. Alerts include comparative tables of top rules, unique attack vectors, and direct links to the relevant events in the PT AF interface. Over four weeks the detector surfaced roughly 1,100 anomalies across the cloud, with expert review confirming that 69 percent indicated either an attack or a protection misconfiguration.