Methods, Status Codes & Statelessness

HTTP & HTTPS

HTTP is the application-layer protocol structuring client/server request-response exchanges, layered on TCP. HTTPS is HTTP + TLS/SSL encryption — protecting against eavesdropping/tampering. Browsers now flag plain HTTP as "not secure."

Methods

GET     retrieve, no side effects, safe to repeat/cache
POST    create/trigger a state change, not assumed safe to repeat
PUT     replace the ENTIRE resource
PATCH   partially update — only the fields provided
DELETE  remove — conventionally idempotent (repeat = same end state)

Status Code Ranges

2xx success · 3xx redirection (Location header points to the new URL — 301 permanent, 302 temporary) · 4xx client error · 5xx server error. 401 Unauthorized = not authenticated (need to log in); 403 Forbidden = authenticated but not permitted for this resource. 429 Too Many Requests often pairs with a Retry-After header telling the client how long to back off.

Statelessness

Each request is processed independently — no built-in memory of prior requests. Applications layer session continuity on top via cookies or tokens sent with every request, which is exactly why REST's statelessness constraint pairs naturally with token-based auth.