What are the principles of REST, and what does it mean for an operation to be idempotent?

Short answer

REST uses a stateless client-server architecture, resources identified with standard URIs, and standard HTTP methods. An operation is idempotent if executing it N times produces exactly the same final system state as executing it once.

Explanation

GET, PUT, DELETE, HEAD, and OPTIONS are idempotent. Deleting the same resource with DELETE /users/42 ten times still leaves the user deleted; subsequent calls have no additional effect. POST is not idempotent: sending it twice can create duplicate records or financial transactions unless protected with an idempotency key.

Code example

PUT /users/7  {"name": "Sara"}      → idempotent: repeating it leaves the same final state
DELETE /users/7                      → idempotent: a second call just returns 404/204
POST /payments  {"amount": 100}     → NOT idempotent: every retry may charge again

POST /payments  {"amount": 100}
Idempotency-Key: 8f3c1b2e-4a5d-4c7e-9a10-2f6d0b7e9c11
                                     → safe to retry: the server stores the first result per key and replays it

Common mistakes

• Using GET to modify or delete server data (such as /delete-user?id=5), allowing search engines and prefetching to delete user data accidentally.

Follow-up questions

• What is Cross-Origin Resource Sharing (CORS), and why does a browser automatically send an OPTIONS preflight request?

Sources

• Representational state transfer - Wikipedia