Which status code should be used when the requested operation is not allowed on the endpoint's method?

Which status code should be used when the requested operation is not allowed on the endpoint's method?

• A. 200
• B. 201
• C. 405
• D. 500

Answer: (C)

When an endpoint exists but the HTTP method you used isn’t supported for that resource, the server should respond with a 405 Method Not Allowed. This tells the client that the requested operation isn’t allowed for the endpoint’s current method, and it’s not a matter of missing permissions but of the method itself. The server may also include an Allow header listing which methods are actually permitted for that resource, guiding you to use a supported one (for example, GET or DELETE instead of POST). Other codes in the options don’t fit this scenario: 200 means the request succeeded, 201 means a new resource was created, and 500 means there’s a server error.

When an endpoint exists but the HTTP method you used isn’t supported for that resource, the server should respond with a 405 Method Not Allowed. This tells the client that the requested operation isn’t allowed for the endpoint’s current method, and it’s not a matter of missing permissions but of the method itself. The server may also include an Allow header listing which methods are actually permitted for that resource, guiding you to use a supported one (for example, GET or DELETE instead of POST).

Other codes in the options don’t fit this scenario: 200 means the request succeeded, 201 means a new resource was created, and 500 means there’s a server error.