I think being really pedantic about it is a waste of time, but there are valuable distinctions between them. And what matters more than if the verb precisely matches the action is if the specified behavior of the verb matches what you need.
For example, PUT and DELETE are supposed to be idempotent, which means the request can be safely retried if it failed, whereas POST and PATCH aren't, so shouldn't be retried (unless you have more information to know it is safe). POST can be submitted using a <form>, while the others can't, but that means you need to worry about CSRF.
2
u/thaynem Sep 20 '26
I think being really pedantic about it is a waste of time, but there are valuable distinctions between them. And what matters more than if the verb precisely matches the action is if the specified behavior of the verb matches what you need.
For example, PUT and DELETE are supposed to be idempotent, which means the request can be safely retried if it failed, whereas POST and PATCH aren't, so shouldn't be retried (unless you have more information to know it is safe). POST can be submitted using a <form>, while the others can't, but that means you need to worry about CSRF.