GET must be safe and idempotent, PUT/DELETE idempotent, and POST for non-idempotent creates. Never mutate state on a GET.
Why This Matters
Misusing methods (e.g. state-changing GETs) breaks caching, prefetching, and retries, and can be triggered accidentally by crawlers.
Related Rules
Catch this automatically on every PR
BeforeMerge scans your pull requests against this rule and dozens more. Get actionable feedback before code ships.