How to complete the challenge POST /api/heartbeat as DELETE (405)

By Alan Richardson · Published 2026-07-31

Send a normal POST request to /api/heartbeat, but add this header:

X-HTTP-Method-Override: DELETE

The server treats the request as a DELETE and returns 405.

Try it now

POST /api/heartbeat with DELETE override to trigger 405

Lessons Learned

• X-HTTP-Method-Override: DELETE lets a POST tunnel a method that the endpoint then evaluates as DELETE.
• The final status comes from the effective method, not from the outer POST.
• Method override tests should verify both the override header and the endpoint rules.

Suggested Experiments

• Remove X-HTTP-Method-Override and compare plain POST /api/heartbeat with the overridden DELETE.
• Change only the override value to PATCH and check whether the status follows PATCH behavior.

Experiment with this endpoint