HTTP Cheatsheet

Methods and idempotency

• GET: read a resource — Fetches data and must not change anything. It is safe and idempotent, so it can be cached and retried.
• POST: create or trigger something — Sends data to be processed, usually creating a resource. It is not idempotent: repeating it can create duplicates.
• PUT: replace a resource — Replaces the whole resource at a URL. It is idempotent: repeating it leaves the same result.
• PATCH: change part of a resource — Applies a partial update to a resource.
• DELETE: remove a resource — Deletes the resource. It is idempotent: deleting twice leaves the same state.
• HEAD and OPTIONS — HEAD returns only the headers. OPTIONS asks what a server allows, and browsers use it for CORS preflight requests.

Status codes

• 200 OK — The request succeeded and the response has a body.
• 201 Created — A resource was created. Send its URL in a Location header.
• 204 No Content — The request succeeded and there is nothing to return, common for DELETE and PUT.
• 301 and 308: permanent redirects — The resource has moved for good. 308 keeps the request method; browsers may change POST to GET on 301.
• 302 and 307: temporary redirects — The resource is temporarily elsewhere. 307 keeps the request method.
• 304 Not Modified — The cached copy is still valid, so no body is sent. It answers a conditional request.
• 400 Bad Request — The request is malformed or invalid, for example bad JSON or a failed validation.
• 401 Unauthorized — Authentication is missing or invalid. Despite the name, it means unauthenticated.
• 403 Forbidden — The server knows who you are but you are not allowed to do this.
• 404 Not Found — No resource exists at this URL.
• 409 Conflict — The request conflicts with the current state, such as a duplicate or an edit conflict.
• 422 Unprocessable Content — The request is well-formed but its content failed validation. Many APIs use it for field errors.
• 429 Too Many Requests — The client is rate limited. Check Retry-After for when to try again.
• 500 Internal Server Error — The server hit an unexpected error. It is the server's fault, not the client's.
• 502, 503 and 504 — 502: a gateway got a bad reply from upstream. 503: the service is unavailable or overloaded. 504: the gateway timed out waiting for upstream.

Request and response headers

• Content-Type: describe the body — Tells the receiver the media type of the body. Send it with JSON requests.
• Accept: ask for a format — Says which media types the client can handle.
• Authorization: send credentials — Carries a bearer token or other credentials. Send it only over HTTPS.
• Location: where to go next — Gives the URL of a created resource, or the target of a redirect.
• User-Agent: identify the client — Identifies the software making the request.
• Content-Length and Transfer-Encoding — The body size in bytes. Chunked transfer is used when the size is not known in advance.
• Retry-After: when to try again — Tells clients how long to wait, in seconds or as a date, after a 429 or 503.

Caching

• Cache static files for a year — Safe for files whose names change with their content, such as app.3f9a1c.js.
• Never store a response — Use it for responses with private or sensitive data.
• Always check with the server — The cache may keep a copy but must revalidate it before each use.
• ETag: a version label — A fingerprint of the response. Clients send it back to ask whether the resource changed.
• If-None-Match: a conditional request — Send the ETag you have. The server answers 304 with no body if it is unchanged.
• Vary: cache by request header — Says which request headers change the response, so caches store separate copies.

Cookies, CORS and security headers

• Set a secure session cookie — HttpOnly hides it from JavaScript, Secure restricts it to HTTPS, and SameSite limits cross-site sending.
• Allow a cross-origin site (CORS) — Lets a browser app on another origin read the response. Avoid * for requests with credentials.
• Answer a CORS preflight — The headers a server returns to an OPTIONS preflight request.
• Strict-Transport-Security: force HTTPS — Tells browsers to use HTTPS only for this site for a year.
• Content-Security-Policy: limit what loads — Restricts where scripts, styles and images may come from, which reduces the impact of XSS.
• X-Content-Type-Options: stop type guessing — Stops browsers guessing a file's type from its content.
• Block clickjacking — Prevents other sites from embedding your pages in frames.

Inspect requests with curl

• See response headers — Print the response headers along with the body.
• See only the headers — Send a HEAD request and print the headers.
• See the whole conversation — Print the request headers, response headers and TLS details.
• Follow redirects — Follow Location headers and show each hop with -i.
• Print only the status code — Discard the body and print the HTTP status.
• Test conditional caching — Send an ETag and check for a 304 response.

Related cheatsheets

• Ansible 2 cheatsheet — Run ad-hoc commands and playbooks, manage inventories, roles, collections and secrets with Ansible.
• Argo CD 3 cheatsheet — Install Argo CD, define Applications declaratively, and manage sync, diffs, history and rollbacks with the argocd CLI.
• AWS CLI 2 cheatsheet — Configure credentials and manage S3, EC2, Lambda, logs, containers and secrets with the AWS CLI v2.
• Azure CLI 2 cheatsheet — Sign in and manage resource groups, VMs, web apps, storage, Kubernetes, registries and secrets with the az command.
• Bash and Linux 5 cheatsheet — Everyday shell and Linux commands for files, searching text, permissions, processes and servers.
• Claude API cheatsheet — Call Claude from Python, TypeScript or curl: messages, streaming, thinking, tools, structured output, caching, batches and error handling.

Browse all cheatsheets