UUID Studio

405 Method Not Allowed

The URL exists but does not support the HTTP method used.

What 405 means

405 says the resource is there but the verb is wrong - a POST to a read-only endpoint, a DELETE where only GET and PUT are implemented. It is a useful distinction from 404, because it confirms the path is right and narrows the problem to the method.

The specification requires an Allow header listing the methods the resource does support. This is very often omitted, which removes the one piece of information that makes the response actionable - the client knows it used the wrong method but not which one to use.

A frequent and confusing cause is a missing OPTIONS handler. Browsers send an OPTIONS preflight before many cross-origin requests, and a framework that does not handle OPTIONS returns 405 - which surfaces to the developer as a CORS error rather than as the missing handler it actually is.

Common causes of a 405

  • Genuinely using the wrong verb for the endpoint.
  • No OPTIONS handler, so a CORS preflight gets 405 - reported to the browser as a CORS failure.
  • A route defined for one method only, where the client assumed REST conventions.
  • A proxy or CDN configured to allow only a subset of methods.
  • A 301/302 redirect converting a POST to a GET, which then hits a GET-only route.

How to fix a 405

  • Send an Allow header listing the supported methods - it is required and it makes the error self-explanatory.
  • Implement OPTIONS on any route reachable cross-origin.
  • Check whether a redirect changed the method before it arrived.
  • Confirm your CDN or proxy is not restricting methods.

Headers this status expects

  • Allow - required. A comma-separated list of the methods this resource supports.

Should a client retry?

Retrying with the same method fails identically. Change the method.

FAQ

Does 405 require an Allow header?
Yes, the specification requires it, and omitting it is the difference between an actionable error and a guessing game. It should list every method the resource supports.
Why does my CORS request fail with a 405?
Because the browser's OPTIONS preflight hit a route with no OPTIONS handler. The real request is never sent, and the browser reports a CORS error rather than the missing handler. Implement OPTIONS on cross-origin routes.
405 or 501?
405 means this specific resource does not support the method, while others might. 501 Not Implemented means the server does not support the method at all, for any resource.

Often confused with