Resources and methods Required
Use each method for what it means
Read with GET, create with POST, replace with PUT, change part with PATCH and remove with DELETE. GET and HEAD never change stored data.
How to do it
Follow RFC 9110. GET, HEAD and OPTIONS are safe, so crawlers, prefetchers and caches may call them at will. PUT and DELETE are idempotent, so sending them twice has the same effect as once. POST is neither, and PATCH is not idempotent in general. Make them safe to repeat with an idempotency key. A second DELETE of the same resource may answer 404, as long as the stored state stays the same.
How to check
A test snapshots the stored data, calls every GET route twice and snapshots again. Nothing changed. Another test proves a repeated PUT or DELETE leaves the same state as one call.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/resources-and-methods/http-methods.