Which HTTP methods are safe and idempotent, and why does it matter?

Summary

Safe methods (GET, HEAD, OPTIONS) don't change state; idempotent methods (GET, HEAD, PUT, DELETE, OPTIONS) have the same effect whether called once or many times. POST and PATCH are not idempotent by default.

Longer Answer

Idempotency lets clients, proxies and SDKs retry safely after timeouts. Caches and crawlers assume GET is safe, so never change state on GET. Make POST retry-safe with idempotency keys.

Key Points

• Safe: no state change
• Idempotent: repeatable
• POST/PATCH need idempotency keys
• Never mutate on GET

Comparison / Tradeoffs