Verb Tampering

R3zk0n · October 2, 2025

Contents

    RESTful APIs often tie functionality to HTTP request methods, or verbs.

    • In other words, a service might have one URL but perform different actions based on an HTTP request’s method. An HTTP request sent with the GET method is meant to retrieve data or an object. This method is sometimes referred to as a safe method since it should not modify the state of an object. However, applications can intentionally break this pattern.
    • As if the terminology used for web services wasn’t confusing enough, a method can also refer to an individual operation in a SOAP web service. For example, “lookupUser” and “updateUser” might be individual methods of a Users SOAP web service. All SOAP requests are usually sent with an HTTP POST request.
    • A POST request usually creates a new object or new data. A PUT or PATCH request updates the data of an existing object. Applications might handle these two verbs differently, but a PUT request usually updates an entire object while a PATCH request updates a subset of an object.
    • Finally, a DELETE request deletes an object. Alternatively, some web services may handle a delete operation in a POST request coupled with certain parameters.
    • It is important to remember that all of this is application-specific. A RESTful web service might not implement everything according to the REST standard. Additionally, a service endpoint might not support every HTTP method.

    Twitter, Facebook