405 Method Not Allowed
The URL exists but does not support the method you used. The Allow header lists the methods it does support.
At a glance
- Status code
- 405 Method Not Allowed
- Class
- 4xx, client error, the request itself is the problem
- Defined in
- RFC 9110
- Cacheable by default
- yes
- Response body
- Optional, plus a mandatory Allow header.
In detail
A GET-only endpoint received a POST, or a collection received a DELETE. The resource is real, the verb is wrong.
The Allow header is required, not optional. Without it the client learns only that something is wrong, not what to try instead.
Read the Allow header before changing anything. It is the authoritative list, and it is frequently different from the documentation.
Examples
HTTP/1.1 405 Method Not Allowed
Allow: GET, HEAD, OPTIONS
Content-Length: 0Things that catch people out
- A CORS preflight sends OPTIONS. A server that does not handle OPTIONS returns 405 and the browser reports it as a CORS failure, which sends people looking in the wrong place.
- 405 is cacheable by default, so adding support for a method later may not take effect for clients behind a cache.
Try it: HTTP Request Builder
Build a request with any method, headers and body, send it, and read the status line the server returns.
HTTP Request Builder
LOCAL · Browser-OnlyBuild and test HTTP requests with custom headers and body
Authentication
Headers
Generate Code
curl -X GET 'https://api.example.com/endpoint' \
-H 'Content-Type: application/json'Showing a sample URL. Enter your endpoint above to update the snippet.
Related HTTP status codes
All http status codes →501 Not Implemented
The server does not support the functionality required to fulfil the request, typically an unrecognised request method.
400 Bad Request
The server refused the request because it was malformed. The client must change something before retrying, because repeating the same bytes will fail.
404 Not Found
The server has no representation for this URL and will not say whether it ever did. The most common status code on the web after 200.
406 Not Acceptable
The server cannot produce a representation that matches the Accept headers the client sent.
407 Proxy Authentication Required
A proxy between the client and the server needs credentials. This is 401 raised by the intermediary rather than by the origin.
408 Request Timeout
The server gave up waiting for the client to finish sending the request and closed the idle connection.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL