breakitdown

405 Method Not Allowed

Answer

405 Method Not Allowed means the server recognizes the URL but the resource does not support the HTTP method you used, such as a POST to a GET-only endpoint. The Allow response header lists the methods that work.

405
Method Not Allowed RFC 9110 §15.5.6

The URL exists, but it does not accept this HTTP method.

For example a POST to an endpoint that only defines GET. The server must list the allowed methods in an Allow header. A frequent cause is a missing trailing slash: the framework redirects to the slashed URL, the client follows with GET, and the GET-only route behind it, or a static file server, answers 405.

Explained

The spec requires an Allow header on a 405, so read it first: Allow: GET, HEAD tells you the endpoint is read-only. A missing Allow header is a server bug, but the meaning is the same.

405 differs from 501. 501 means the server does not implement the method at all; 405 means it does, but not for this resource.

A common trap is a redirect in the middle. If you POST to /api/items and the server issues a 301 or 302 to /api/items/, the client follows with GET, and a POST-only route answers 405. Use the canonical URL, or have the server redirect with 307 or 308 so the method is kept.

How to debug it

  1. Read the Allow header on the 405 response.
  2. Check the exact URL, including the trailing slash, and whether a redirect happened before the 405 (curl -v shows each hop).
  3. Confirm the route is registered for this method in the framework, for example methods=["POST"] in Flask.
  4. If a static file server or CDN serves the path, it may only allow GET and HEAD; route API paths to the application.
  5. For browser requests, check whether the 405 is on the OPTIONS preflight; the server must answer OPTIONS for cross-origin requests to succeed.

Gotchas

Related explainers

← All HTTP status codes