HTTP & REST cheat sheet · .NET Academy

Methods

Method	Meaning	Safe	Idempotent	Typical success
`GET`	Read	✓	✓	`200`
`HEAD`	Headers only	✓	✓	`200`
`POST`	Create / action	✗	✗	`201` + `Location`, or `202`
`PUT`	Replace	✗	✓	`200` / `204`
`PATCH`	Partial update	✗	usually ✗	`200` / `204`
`DELETE`	Remove	✗	✓	`204`
`OPTIONS`	Capabilities / CORS preflight	✓	✓	`204`

Status codes

Code	Name	When
`200`	OK	Success with a body
`201`	Created	Resource created — add `Location`
`202`	Accepted	Queued for background processing
`204`	No Content	Success, no body (DELETE, some PUT/PATCH)
`301` / `308`	Moved Permanently	URL changed for good
`302` / `307`	Found / Temporary Redirect	Temporary redirect (e.g. http → https)
`304`	Not Modified	Cached copy still valid (`ETag` / `If-None-Match`)
`400`	Bad Request	Malformed or invalid input
`401`	Unauthorized	Not authenticated — log in / send a token
`403`	Forbidden	Authenticated but not allowed
`404`	Not Found	No such resource (or hidden from this user)
`405`	Method Not Allowed	Wrong method for this URL — add `Allow`
`409`	Conflict	Duplicate, or outdated version
`415`	Unsupported Media Type	Wrong `Content-Type`
`422`	Unprocessable Content	Well-formed but semantically invalid
`429`	Too Many Requests	Rate limited — add `Retry-After`
`500`	Internal Server Error	Unhandled server bug
`502` / `504`	Bad Gateway / Gateway Timeout	Upstream failed / too slow
`503`	Service Unavailable	Overloaded or down for maintenance

Headers

Header	Purpose
`Content-Type: application/json`	Body format
`Accept: application/json`	Desired response format
`Authorization: Bearer <token>`	Credentials
`Cookie` / `Set-Cookie`	Session state (`Secure; HttpOnly; SameSite=Lax`)
`Cache-Control: max-age=60` / `no-store`	Caching rules
`ETag` / `If-None-Match`	Conditional requests
`Location`	URL of a created resource or redirect target
`Retry-After`	When to try again (429, 503)
`Strict-Transport-Security`	HTTPS only (HSTS)
`Access-Control-Allow-Origin`	CORS
`Idempotency-Key`	Safe retries of POST

REST conventions

GET    /products?category=books&sort=-price&limit=20&after=abc   list (filter, sort, cursor)
GET    /products/42                                              one
POST   /products                                                 create
PUT    /products/42                                              replace
PATCH  /products/42                                              update fields
DELETE /products/42                                              delete
GET    /customers/7/orders                                       sub-collection
POST   /orders/42/cancellation                                   action as a resource

Nouns in URLs, plural collections, verbs = HTTP methods.
Errors as Problem Details (application/problem+json): type, title, status, detail, errors.
Paginate collections; version breaking changes (/v2/...); make retries safe.

Raw request and response

POST /api/orders HTTP/1.1
Host: shop.example
Content-Type: application/json
Authorization: Bearer eyJhbGciOi…
 
{"productId": 1, "quantity": 2}

HTTP/1.1 201 Created
Content-Type: application/json; charset=utf-8
Location: /api/orders/1001
 
{"id": 1001, "status": "pending"}