8.2HTTP Methods

Method	Purpose	Idempotent?	Safe?
GET	Retrieve resource	Yes	Yes
POST	Create resource	No	No
PUT	Replace resource entirely	Yes	No
PATCH	Partial update	No	No
DELETE	Remove resource	Yes	No
HEAD	Same as GET but no body	Yes	Yes
OPTIONS	Discover allowed methods	Yes	Yes

What Idempotent Means for Testing

An idempotent request produces the same result whether you send it once or ten times. This matters for retry logic and test reliability:

• PUT /users/123 {"name": "Alice"} — send it 10 times, the user is still named "Alice"
• POST /users {"name": "Alice"} — send it 10 times, you may get 10 users (or 409 Conflict if email is unique)
• DELETE /users/123 — first call deletes the user, subsequent calls return 404 (but the state is the same: user is deleted)

What to Test for Each Method

# GET: verify response content and caching
def test_get_user(api):
    r = api.get("/users/1")
    assert r.status_code == 200
    assert r.headers["Content-Type"] == "application/json"
    assert "id" in r.json()

# POST: verify creation and response
def test_create_user(api):
    r = api.post("/users", json={"name": "Alice", "email": "alice@test.com"})
    assert r.status_code == 201
    assert "id" in r.json()
    # Verify the user actually exists
    get_r = api.get(f"/users/{r.json()['id']}")
    assert get_r.status_code == 200

# PUT: verify full replacement
def test_update_user(api):
    r = api.put("/users/1", json={"name": "Bob", "email": "bob@test.com"})
    assert r.status_code == 200
    # Verify ALL fields are what you sent (PUT replaces everything)
    user = api.get("/users/1").json()
    assert user["name"] == "Bob"

# DELETE: verify removal
def test_delete_user(api):
    r = api.delete("/users/1")
    assert r.status_code == 204
    # Verify the user is gone
    get_r = api.get("/users/1")
    assert get_r.status_code == 404