Method	Description
`GET`	Retrieves data from a resource
`HEAD`	Same as GET but returns headers only (no body)
`POST`	Sends data (e.g., form submission, resource creation)
`PUT`	Replaces entire resource
`DELETE`	Removes a resource
`OPTIONS`	Returns supported methods/options for a resource
`TRACE`	Echoes request path for debugging
`PATCH`	Partially updates a resource

Safe = No state change
- Only: GET, HEAD, OPTIONS, TRACE
Idempotent = Repeat ≈ Same result
- Includes: GET, HEAD, PUT, DELETE, OPTIONS, TRACE
POST vs PUT vs PATCH (Critical Distinction)
- POST → Create / submit (non-idempotent)
- PUT → Replace entire resource (idempotent)
- PATCH → Partial update (non-idempotent)

🔐 Pentesting / API Security Insight

From a security perspective, this table is not just theory:

Run:

curl -X OPTIONS <https://target.com> -i

nmap --script http-methods