A method is safe if it does not change server state: GET, HEAD and OPTIONS. A method is idempotent if making the same request many times has the same effect as making it once: GET, HEAD, OPTIONS, PUT and DELETE. Every safe method is idempotent; the reverse is not true, because a DELETE changes state and is still idempotent.
These properties are what make automatic retries possible. A proxy, a browser or an HTTP library may retry an idempotent request after a timeout without asking, because repeating it cannot make things worse. POST and PATCH are neither safe nor idempotent, which is why nothing retries them for you — and why an Idempotency-Key header exists, to give a POST the property it lacks by nature.
That idempotent means "returns the same response". It means the same *effect* on the server. A second DELETE of the same resource is idempotent even though the first returns 204 and the second returns 404: the end state — the thing is gone — is identical.
`GET /starfleet/v1/tribbles` is a deliberate anti-pattern: a GET that doubles the count every time you read it. It is the clearest demonstration here of what "safe" is protecting you from.
All glossary terms · Testing techniques · All 39 mock REST APIs