What are the main HTTP methods and how do they map to CRUD operations?
Learn how GET, POST, PUT, PATCH, and DELETE map to CRUD create, read, update, and delete operations, plus safety and idempotency — with examples.
Expected Interview Answer
The main HTTP methods are GET, POST, PUT, PATCH, and DELETE, and they map to the CRUD operations as follows: POST creates, GET reads, PUT/PATCH update, and DELETE removes a resource.
GET retrieves a resource and is safe and idempotent. POST creates a new resource and is neither safe nor idempotent, since calling it twice makes two resources. PUT replaces a resource entirely and is idempotent, while PATCH applies a partial update. DELETE removes a resource and is idempotent. Understanding safety and idempotency matters because they govern caching, retries, and how proxies treat each method.
- Predictable, self-documenting API semantics
- Safe methods can be cached and prefetched
- Idempotent methods are safe to retry
- Clear mapping simplifies client and server code
- Aligns with HTTP tooling and proxies
AI Mentor Explanation
The HTTP methods are like the fixed roles of a cricket innings. GET is checking the scoreboard (it changes nothing, so you can look repeatedly), POST is a new batter walking out to create a fresh partnership, PUT is swapping an entire batting order sheet, PATCH is a single substitution, and DELETE is declaring an innings closed. Each action has a defined, predictable effect just like each verb.
Step-by-Step Explanation
Step 1
Map create to POST
Send POST to a collection URL like /users to create a new resource; the server assigns its ID.
Step 2
Map read to GET
Use GET on /users or /users/42 to retrieve resources without side effects; it is safe and cacheable.
Step 3
Map update to PUT or PATCH
Use PUT to replace a resource fully, PATCH to modify specific fields; both target /users/42.
Step 4
Map delete to DELETE
Send DELETE to /users/42 to remove that resource; repeating it should leave the same end state.
Step 5
Respect safety and idempotency
Keep GET side-effect free, and design PUT, PATCH, and DELETE so retries do not cause harm.
What Interviewer Expects
- Correct verb-to-CRUD mapping
- Understanding of safe versus unsafe methods
- Understanding of idempotency and why it matters
- Difference between PUT and PATCH
- Awareness of collection versus item URLs
Common Mistakes
- Using GET to change data
- Claiming POST is idempotent
- Confusing PUT (full replace) with PATCH (partial update)
- Using POST for everything, RPC-style
- Ignoring status codes like 201 Created and 204 No Content
Best Answer (HR Friendly)
“HTTP has a small set of standard actions — GET to read, POST to create, PUT and PATCH to update, and DELETE to remove — which line up neatly with the four basic data operations known as CRUD. Using them consistently makes an API predictable and easy to work with.”
Code Example
POST /api/users -> 201 Created (Create)
GET /api/users/42 -> 200 OK (Read)
PUT /api/users/42 -> 200 OK (Update - full)
PATCH /api/users/42 -> 200 OK (Update - partial)
DELETE /api/users/42 -> 204 No Content (Delete)Follow-up Questions
- What is the difference between PUT and PATCH?
- Which HTTP methods are idempotent and why?
- What does a safe HTTP method mean?
- Which status codes suit create, update, and delete?
- Can GET requests have a request body?
MCQ Practice
1. Which HTTP method maps to the Create operation in CRUD?
POST creates a new resource in a collection; it is neither safe nor idempotent because repeating it creates duplicates.
2. Which method is safe and idempotent?
GET only reads data, so it is safe (no side effects) and idempotent (repeating it yields the same result).
3. What best distinguishes PUT from PATCH?
PUT replaces the entire resource representation, while PATCH applies a partial modification to specific fields.
Flash Cards
CRUD to HTTP mapping? — Create=POST, Read=GET, Update=PUT/PATCH, Delete=DELETE.
Is POST idempotent? — No. Repeating POST creates multiple resources, so it is neither safe nor idempotent.
PUT vs PATCH? — PUT replaces the whole resource; PATCH updates only the specified fields.
What is a safe method? — One with no side effects on the server, such as GET; it can be cached and prefetched.