Online Tool Store
HTTP Methods Auditor
Audit which HTTP methods (GET, POST, PUT, DELETE, TRACE, and more) an API endpoint allows, with security notes for each, example result shown.
This works right here on your device — nothing gets sent out.
Example shown - auditing an arbitrary endpoint's allowed HTTP methods requires a cross-origin request, which browsers block for security (CORS). This preview doesn't connect to other domains.
| Method | Status | Notes |
|---|
How the HTTP methods auditor works
- Enter an API endpoint URL and click Audit methods.
- Review which HTTP methods (GET, POST, PUT, DELETE, and more) are allowed.
- Check the notes for security-relevant guidance on each method.
FAQ
Why can't this tool check any endpoint I enter?
Determining which HTTP methods a server allows requires sending real requests (including an OPTIONS preflight) to that server from your browser, which is blocked for cross-origin requests by CORS unless the target explicitly allows it.
Why does TRACE being blocked matter?
The TRACE method can be used in cross-site tracing attacks to read HTTP headers (including cookies) that JavaScript normally can't access - disabling it is a common security best practice.
How can I audit my own server's allowed methods?
Use a command-line tool like curl with the -X OPTIONS flag, or check your server's configuration directly, since same-origin or server-side tools aren't restricted by browser CORS rules.
Why does OPTIONS matter for an API?
Browsers automatically send an OPTIONS preflight request before certain cross-origin requests to check what methods and headers are allowed - if OPTIONS isn't handled correctly, legitimate cross-origin API calls can fail.
How we compare
| Feature | Online Tool Store | curl -X OPTIONS | API security scanner |
|---|---|---|---|
| Clear method-by-method breakdown | ✓ | ✗ | ✓ |
| No install required | ✓ | ✗ | ✗ |
| Real cross-origin scanning | ✗ | ✓ | ✓ |
For a real audit of your own API's allowed methods, use curl or a server-side security scanning tool.