Skip to content

405 Method Not Allowed

The URL exists but does not support the HTTP method that was used.

Status

HTTP/1.1 405 Method Not Allowed

Details

  • Category: 4xx
  • Status: Standard. Registered with IANA and defined by a current standards-track RFC.
  • Specification: RFC 9110 §15.5.6
  • Cacheable: Cacheable by default
  • Response body: Allowed
  • Retry: Retry only after changing the request

405 confirms the resource is there and rejects the verb. A collection endpoint that accepts GET and POST answers 405 to a DELETE. The response must include an Allow header listing the methods that are supported, which is the difference between a helpful 405 and a frustrating one.

It also shows up when infrastructure rather than the application refuses the method: static file servers reject POST to a file, and some CDNs and WAFs block PUT, PATCH, or DELETE at the edge before the origin ever sees them.

Note: A 405 must include an Allow header. Without it the client cannot tell which methods the resource supports.

Headers

  • Allow: Required. Comma-separated list of supported methods, e.g. GET, HEAD, POST.

Common causes

  • Using POST where the route only defines GET, or the reverse.
  • A trailing slash difference routing the request to a different handler.
  • A static file server or CDN rejecting write methods.
  • A CORS preflight OPTIONS request hitting a route that does not handle OPTIONS.

How to fix it

As the client

  • Read the Allow header and use one of the listed methods.
  • Check for method override conventions. Some frameworks expect POST with a _method field rather than a real PUT or DELETE.

As the server

  • Always send Allow. It costs nothing and removes a support round trip.
  • Handle OPTIONS on every route that browsers call cross-origin.
  • Return 404 rather than 405 if the existence of the URL should not be revealed.

Examples

Using a method the route does not support

A DELETE against a collection endpoint that only accepts GET and POST:

HTTP request

DELETE /api/v2/order HTTP/1.1
Host: api.example.com

The Allow header lists what the resource does support:

HTTP response

HTTP/1.1 405 Method Not Allowed
Allow: GET, POST
Content-Type: application/json; charset=utf-8

{"error":"method_not_allowed","allowed":["GET","POST"]}

Specifications

See also