405 Method Not Allowed

This is an educational reference page about HTTP 405 Method Not Allowed. The page itself is served as 200 OK so it can be indexed as HTTP documentation.

The server knows the request method, but the target resource does not support it. The response must include an Allow header.

Specification

Registered in the IANA HTTP Status Code Registry as Method Not Allowed. Defined in RFC 9110, Section 15.5.6.

What it means

HTTP 405 Method Not Allowed means the server recognizes the request method, but this resource does not support it. RFC 9110 requires an Allow header listing the methods the resource currently supports, such as Allow: GET, HEAD.

When to use it

Return 405 for DELETE on a read-only resource, or POST to a URL that only serves GET.
Return 501 Not Implemented instead when the server does not recognize the method for any resource.

Common causes

A form posting to a URL that only accepts GET.
A route that is registered for GET but not for POST, PUT, or DELETE.
A static file host receiving POST, which most static servers reject.
A redirect that changed the method. After a 301 or 302, many clients switch POST to GET.

Headers involved

Allow is required on 405. It lists the methods the resource supports.
Access-Control-Allow-Methods is a CORS response header for preflight requests. It is separate from Allow.

How to fix it

Read the Allow header and send one of the listed methods.
Check the route definitions for the method the client sends.
Use 307 or 308 for redirects that must keep the method and body.

Examples

DELETE on a read-only resource

DELETE /api/invoices/2026-0193 HTTP/1.1
Host: api.example.com

HTTP/1.1 405 Method Not Allowed
Allow: GET, HEAD
Content-Type: application/json

{
  "error": "Invoices cannot be deleted. Issue a credit note instead."
}

Common mistakes

Leaving out the Allow header. RFC 9110 requires it.
Returning 404 for a known URL with an unsupported method. Clients then think the URL is wrong.
Returning 405 when the user lacks permission for the method. That is 403.

Developer notes

405 is heuristically cacheable. If a resource will start accepting a method soon, such as after a deploy, set Cache-Control on 405 responses.

Questions

What does HTTP 405 Method Not Allowed mean?

HTTP 405 means the server recognizes the method but the requested resource does not support it. The Allow header lists the methods that work.

What is the difference between 405 and 501?

405 means this resource does not support the method. 501 means the server does not support the method for any resource.

Header and content rules

What RFC 9110 says about a 405 response, quoted from the RFC. The 4xx class rules also apply.

MUST (origin server; Allow): Send Allow listing the methods the target resource supports now. Table row
The origin server MUST generate an Allow header field in a 405 response containing a list of the target resource's currently supported methods. RFC 9110 §15.5.6

The same rule is in the response obligations table and its JSON.