Skip to main content

How to complete the challenge POST /api/heartbeat as Trace (501)

By Published

Send a normal POST request to /api/heartbeat, but add this header:

X-HTTP-Method-Override: TRACE

The server treats the request as TRACE and returns 501 Not Implemented.

Try it now

Browser HTTP clients cannot send TRACE methods. The HTTP client below is closed by default because it cannot complete this challenge from the browser; try it for yourself to see.

POST /api/heartbeat with TRACE override to trigger 501

Lessons Learned

  • X-HTTP-Method-Override: TRACE demonstrates how unsupported effective methods are reported.
  • 501 Not Implemented should be tied to TRACE, not the carrier POST.
  • Browser clients often restrict TRACE, so override support can make the test possible.

Suggested Experiments

  • Compare direct TRACE /api/heartbeat with the override version if your client allows direct TRACE.
  • Change the override header case or spacing and see how strict the parser is.
Experiment with this endpoint

 

Copyright Compendium Developments Ltd 2020 - 2026