405 Method Not Allowed

The target resource exists but does not support the HTTP method used in the request; the response must list the allowed ones.

Defined in RFC 9110 §15.5.6

What 405 means

405 Method Not Allowed means the target resource exists and is understood by the server, but does not support the HTTP method used in the request. RFC 9110 requires the response to include an Allow header listing the methods the resource does support, so a well-behaved client, or a developer debugging in a terminal, can immediately see what would have worked. This distinguishes 405 from 404: the URI is valid and reachable, only the verb applied to it is wrong.

In REST APIs, 405 typically shows up when a route is registered for GET and POST but a client sends PUT or DELETE, or when a resource is intentionally read-only and any mutating method is rejected. Static file servers return 405 for methods like POST or DELETE against a plain file, since only GET and HEAD make sense there. Framework routers generate this automatically once a route is defined for one set of methods and a request arrives with another.

CORS preflight requests can surface a 405 indirectly: the browser's OPTIONS preflight succeeds on its own, but the actual method the client wants to use is then rejected by the server's route definition, which looks confusing in the browser's console because the failure appears one step removed from the request the developer actually intended to send, and is easy to mistake for a CORS configuration problem rather than a plain wrong-verb error.

Common causes

The client used an HTTP verb, such as PUT, DELETE, or PATCH, that the endpoint's route was never defined to accept.
The resource is intentionally read-only, and any mutating method is rejected by design.
An API version deprecated a method that a previous version supported.
A static file or directory is being accessed with a method other than GET or HEAD.
A CORS preflight succeeds but the actual request method is not in the server's allowed list for that route.

How to fix a 405

If you are the client (browser user or API caller)

Check the API documentation or the response's Allow header for the methods the endpoint actually supports.
Update client code or SDK calls to use the correct verb for the operation being performed.
Confirm the endpoint hasn't changed its supported methods since the client integration was last updated.

If you run the server

Always include an Allow header listing every method the resource genuinely supports.
Add or fix the route handler for a method that should be supported but currently returns 405.
Return a response body that clarifies this is a wrong-verb error, distinct from a 404 not-found.

Example

PUT /articles/42 HTTP/1.1
Host: api.example.com

HTTP/1.1 405 Method Not Allowed
Allow: GET, HEAD
Content-Type: application/json

{"error": "method_not_allowed", "message": "Articles are read-only; use the admin API to edit"}

The Allow header tells the client exactly which methods this resource supports instead of leaving it to guess.

Try it live

Our free status responder returns a real HTTP 405 you can point tests, monitors or a browser at.

GET https://mcp.httpstatus.com/status/405