Is the Allow header required?

Yes — the specification requires a 405 to include it. Many servers omit it anyway, which is worth checking for in a contract test.

Why do I get 405 on OPTIONS?

Usually a CORS preflight hitting a server that has no OPTIONS handler. It surfaces in the browser as a CORS failure rather than as the 405 it is.

HTTP 405 Method Not Allowed

The URL exists but not with this method. The response must include an Allow header listing what is permitted.

Defined in RFC 9110 §15.5.6 — 405 Method Not Allowed · MDN reference

Where you meet HTTP 405 in production

A DELETE against a read-only collection, a POST to a URL that only supports GET, a client that has drifted from the API it was written against.

Why you would test it

Read the Allow header rather than guessing. It is the machine-readable answer to "what can I do with this resource?".

What your client should do about a 405

Read the Allow header — a compliant 405 lists the methods that would have worked, which is the fastest route from the error to the fix. Never retry with the same method.

405 versus the codes it gets confused with

405 vs 404 Not Found — A 404 means the path is unknown. A 405 means the path is known and the verb is not supported on it.
405 vs 501 Not Implemented — 501 means the server does not implement the method at all, anywhere. 405 is about this resource.

Endpoints that return 405

2 endpoints in this playground answer with 405. Every one is free, needs no signup, and can be called from the browser or with curl.

DELETE https://funapi.dev/api/pizza/v1/menu — Always. GET is the only supported method on /menu. (Pizza Orders API) Open & run this endpoint
GET https://funapi.dev/api/faults/v1/status/{code} — Returned on request (Fault Injection API) Open & run this endpoint

Questions about HTTP 405

Is the Allow header required?: Yes — the specification requires a 405 to include it. Many servers omit it anyway, which is worth checking for in a contract test.
Why do I get 405 on OPTIONS?: Usually a CORS preflight hitting a server that has no OPTIONS handler. It surfaces in the browser as a CORS failure rather than as the 405 it is.

Other client error codes

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated 2 October 2026