How to Audit Which HTTP Methods an API Allows

You’re reviewing an API endpoint’s security posture and want to know exactly which HTTP methods it actually responds to — not just the ones your application intentionally uses (typically GET and POST), but whether the server also accepts methods you never explicitly intended to expose, like PUT, DELETE, or even less common ones like TRACE. An endpoint that quietly accepts more methods than its application logic assumes is a real, sometimes-overlooked source of unintended attack surface.

Web frameworks and servers often enable a broader set of methods by default than any given endpoint actually needs, and unless someone deliberately restricts allowed methods, an endpoint built to only be used with GET and POST might still technically respond to other methods — sometimes in ways that weren’t carefully considered from a security standpoint.

What auditing allowed HTTP methods actually reveals

Each HTTP method carries a different semantic meaning and different implications — GET retrieves data, POST typically creates or submits data, PUT and DELETE modify or remove resources, and less common methods like TRACE and OPTIONS serve diagnostic or discovery purposes that aren’t always intended to be exposed publicly. An endpoint that unexpectedly accepts DELETE, for instance, when the application only ever intended read access, represents a mismatch between intended and actual behavior — exactly the kind of gap that’s worth catching deliberately rather than discovering later.

Checking this systematically, rather than assuming an endpoint only does what its application code appears to intend, is what actually confirms the endpoint’s real behavior matches its intended one.

Why people get stuck here

• Assuming an endpoint only accepts the methods it was designed for. Application code intending GET-only access doesn’t automatically mean the underlying server configuration actually restricts other methods from being accepted.
• Default framework or server configurations enabling more methods than needed. Many web servers and frameworks enable a broader set of methods by default, and unless someone deliberately restricts this, unused methods can remain silently accessible.
• Not knowing which methods carry real security implications. Some methods (like TRACE, historically associated with certain cross-site scripting attack techniques) carry known security considerations that aren’t obvious without specific knowledge of each method’s implications.
• Manually testing each method one at a time. Checking every common HTTP method against an endpoint by hand, with a separate request for each, is tedious and easy to do incompletely.

What a good HTTP methods auditor looks like

Checks the full common method set

Testing GET, POST, PUT, DELETE, TRACE, and other common methods against a single endpoint in one pass gives a complete picture rather than requiring separate manual checks.

Includes security notes for each method

Explaining the security implications of each result — not just whether a method is accepted, but why that might matter — turns a raw pass/fail list into something actually actionable.

Presents results clearly

A clean summary of which methods are allowed, with their associated security context, makes it easy to spot an unexpected result that warrants closer investigation.

Common mistakes to avoid

• Assuming an endpoint’s actual accepted methods match what the application code appears to intend, without actually testing.
• Leaving default server or framework method configurations unreviewed, when they often enable a broader set than any given endpoint needs.
• Not recognizing the specific security implications of less common methods like TRACE, which have known associations with certain attack techniques.
• Testing methods manually one at a time, risking an incomplete check that misses an unexpectedly accepted method.
• Treating an unexpectedly allowed method as automatically a critical vulnerability without further investigation — context (like whether the method actually performs a meaningful action) matters for assessing real risk.

How to do it with HTTP Methods Auditor

Online Tool Store’s HTTP Methods Auditor checks an endpoint’s allowed methods directly.

1. Open the HTTP Methods Auditor tool.
2. Enter the API endpoint URL you want to audit.
3. Review which HTTP methods the endpoint responds to.
4. Check the security notes for any unexpectedly allowed method, and restrict server configuration if needed.

It’s a fast way to confirm an endpoint’s real behavior matches its intended, application-level access pattern.

Frequently asked questions

Why would an endpoint accept a method it was never designed to use?

Because many web servers and frameworks enable a broader default set of HTTP methods than any specific endpoint actually needs, and unless someone deliberately restricts allowed methods at the server or route configuration level, the underlying default can remain silently accessible even though the application code only intentionally handles a subset of them.

Is an unexpectedly allowed method automatically a security vulnerability?

Not automatically — it depends on what that method actually does when invoked and whether it exposes any meaningful unintended action or information. It’s worth investigating further rather than assuming the worst, but it’s also not something to dismiss without checking.

Which HTTP methods are generally worth restricting on a public-facing endpoint?

It depends on the endpoint’s actual purpose, but as a general principle, only the methods an endpoint genuinely needs to support should be enabled — a read-only endpoint generally shouldn’t accept PUT or DELETE, and diagnostic methods like TRACE are often worth disabling entirely on public-facing servers unless specifically needed.

Final thought

An API endpoint’s actual behavior isn’t always the same as what its application code appears to intend — auditing the real set of accepted HTTP methods catches a gap that’s easy to overlook until it becomes a real problem.

Try the free HTTP Methods Auditor tool