Method Not Allowed

Overview

405 Method Not Allowed is returned when the server recognizes the request's HTTP method but does not allow it for the target resource — for example sending GET to an endpoint that only accepts POST.

By spec a 405 response must include an Allow header listing the methods the resource actually supports, so the client knows which method to retry with.

When it happens

• It is returned when a write method like PUT/DELETE hits a read-only endpoint, or a GET hits a write-only path.
• It occurs when no handler for that method is registered on the route, or the method is disabled in server config.

Request / Response example

DELETE /api/articles HTTP/1.1
Host: api.example.com

HTTP/1.1 405 Method Not Allowed
Allow: GET, POST
Content-Type: application/json

{"error":"method_not_allowed","allowed":["GET","POST"]}

In code

app.route('/api/articles')
  .get(list)
  .post(create)
  .all((req, res) => res.set('Allow', 'GET, POST').sendStatus(405));

location /api/articles {
    limit_except GET POST { deny all; }  # others -> 405
}

Notes

• If the server does not implement the method at all (for example an unknown extension method), 501 Not Implemented fits better than 405.
• Failing to handle the browser's CORS preflight (OPTIONS) can surface as 405, so verify OPTIONS handling.
• Omitting the Allow header violates the spec and makes it hard for the client to choose an alternative.

Related status codes

Related headers

Specification