The distinction between GET and POST is the most fundamental concept in HTTP architecture.

Safe vs. Unsafe methods

  • HTTP GET is Safe: Defined by RFC 9110 Section 9.2.1, safe methods are read-only. Calling a GET request must not produce side effects (such as deleting an account or submitting an order). Because GET is safe, web crawlers, CDNs, and browsers can freely prefetch and cache responses.
  • HTTP POST is Unsafe: POST requests are designed to mutate server state, process transactions, or append records.

Transmission of parameters

  • GET: Parameters are passed in the URI query string (/v1/search?q=http), making requests bookmarkable and shareable.
  • POST: Parameters are enclosed in the HTTP request body with appropriate Content-Type headers (such as application/json).

How to test with curl

curl -i https://api.example.test/v1/users

Key takeaway

Use GET exclusively for read-only data retrieval where caching and safe prefetching are desired. Use POST for state-changing operations, payload submissions, and non-idempotent actions.