meta
HTTP OPTIONS
Asks the server which communication options (methods, headers, CORS rules) are available for the target resource. Widely used by browsers as the CORS preflight before non-simple cross-origin requests.
OPTIONS /path HTTP/1.1 or OPTIONS * HTTP/1.1Properties
| Property | Value / Meaning |
|---|---|
| Safe | Yes - OPTIONS only inspects capabilities; no state changes. |
| Idempotent | Yes - repeated OPTIONS calls return the same capability set. |
| Cacheable | No by default - though CORS preflights are cached client-side per Access-Control-Max-Age. |
| Has body | Optional - a body is allowed but usually omitted. |
| Body in response | Usually empty - key info arrives in the Allow and Access-Control-* headers. |
Examples
curl -X OPTIONS -i https://api.example.com/usersInspect Allow header to see supported methods.
curl -X OPTIONS -H 'Origin: https://app.example.com' -H 'Access-Control-Request-Method: PUT' -i https://api.example.com/users/1Simulate a CORS preflight for a PUT from a browser.
curl -X OPTIONS -i 'https://example.com/*'Server-wide capabilities via the asterisk-form request-target.
OPTIONS * HTTP/1.1\nHost: example.comRaw asterisk-form asking about the server itself, not a specific resource.
Gotcha
Look at the Allow response header for supported verbs. In CORS, the preflight must return the exact requested method in Access-Control-Allow-Methods and echo any custom headers.
Related methods
HTTP HEAD
Identical to GET but the server must not return a message body in the response. Used to inspect headers - size, type, last-modified - without downloading the payload.
HTTP GET
Requests a representation of the specified resource. It is the most common HTTP method and should have no side effects on the server.
HTTP TRACE
Performs a message loop-back test along the path to the target resource, so the client can see exactly what proxies received. The final recipient echoes the request back as the message body of a 200 response.