HTTP 405 Method Not Allowed

What 405 means

Common causes

• A form or fetch() posting to a static file. nginx serves static files only for GET and HEAD, so POST /index.html gets 405 Not Allowed. It happens when an API request misses the proxy location and falls through to the static root.
• Next.js App Router: route.ts doesn't export a function for that method, e.g. only GET is exported and the client sends POST. Next.js responds 405 automatically.
• CORS preflight: the browser sends OPTIONS before a cross-origin PUT, DELETE or JSON POST. If nothing handles OPTIONS, some frameworks return 405 and the browser reports a CORS error.
• A redirect changed the method: a POST that gets a 301 or 302 (often a trailing-slash redirect) is re-sent as GET, which may not be allowed at the target.
• The wrong method by mistake: PUT vs PATCH, or GET to a search endpoint that only takes POST.
• IIS: the WebDAV module intercepts PUT and DELETE and returns 405 before your ASP.NET app sees them.

How to fix a 405

curl -i -X DELETE https://api.example.com/users

HTTP/2 405
allow: GET, POST

curl -i -X OPTIONS https://api.example.com/users

location /api/ {
    proxy_pass http://127.0.0.1:3000;
}

location / {
    root /var/www/app/dist;
    try_files $uri $uri/ /index.html;
}

// app/api/items/route.ts
export async function GET() {
  return Response.json(await listItems());
}

export async function POST(request: Request) {
  const item = await createItem(await request.json());
  return Response.json(item, { status: 201 });
}
// No DELETE export: DELETE /api/items returns 405

app.route('/api/items')
  .get(listItems)
  .post(createItem)
  .all((req, res) => {
    res.set('Allow', 'GET, HEAD, POST');
    res.status(405).json({ error: 'method_not_allowed' });
  });

Headers that matter with 405

Allow

Required in a 405. An empty value is valid and means the resource currently allows no methods, e.g. when it's disabled by configuration.

Access-Control-Allow-Methods

The CORS equivalent for preflight responses. Missing methods here cause browser CORS errors, not a 405.

405 vs similar status codes

• 404 Not Found: Nothing at the URL at all. Express uses 404 where 405 would be more accurate.
• 501 Not Implemented: The server doesn't recognise or support the method for any resource.
• 403 Forbidden: The method is supported, but this client isn't allowed to use it.

Related status codes

Looking for another code? Search the full HTTP status codes list, or read which code your API should return in the REST API status codes guide.

Learn more

Browse all developer guides →

Frequently Asked Questions