API › Module 2 › Lesson 1
HTTP Methods and Status Literacy
Verbs and codes are the API alphabet — read them on 127.0.0.1:8811.
Visual · rest_methods_status
GET/POST/PUT/PATCH/DELETE + status families. 127.0.0.1:8811.
Opening
If you cannot name the method and the status, you are not reading an API — you are guessing.
REST literacy starts with verbs: GET reads, POST creates or triggers, PUT/PATCH update, DELETE removes — when the server honors that contract. Status families tell the story: 2xx success, 3xx redirect, 4xx client problem, 5xx server problem. Defenders and builders both need that alphabet before they talk about “broken auth.” Original Cyberlium Topic 13 Module 2. Practice reading methods and statuses against YOUR toy on 127.0.0.1:8811 — not against stranger SaaS. You will NOT sqlmap, hydra, or treat 401 as a license to brute-force. Next: curl Headers on YOUR Lab.
1. Methods are promises, not decorations
A GET that deletes a row is a broken contract. A DELETE that always returns 200 with an empty body may still have worked — or may be lying. Literacy means you check method, status, and body together on a dest YOU own.
Safe methods (GET, HEAD) should not change server state. That rule is why caches and crawlers exist. Your lab should demonstrate the difference without attacking a production shop.
Command guide
Try these commands — Methods are promises, not decorations
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
HTTP status codes — https://developer.mozilla.org/en-US/docs/Web/HTTP/Status REST verbs — https://restfulapi.net/http-methods/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS -o /dev/null -w "GET %{http_code}
" http://127.0.0.1:8811/items
curl -sS -o /dev/null -w "POST %{http_code}
" -X POST http://127.0.0.1:8811/items -H "Content-Type: application/json" -d '{"name":"lab"}'
curl -sS -o /dev/null -w "DELETE %{http_code}
" -X DELETE http://127.0.0.1:8811/items/1Primary tools to practice this lesson: curl. Reference sites: HTTP status codes (https://developer.mozilla.org/en-US/docs/Web/HTTP/Status); REST verbs (https://restfulapi.net/http-methods/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Status families you can say at 2 a.m.
401 means unauthenticated (who are you?). 403 means authenticated but not allowed (you may not). 404 means no such resource (or a quiet deny). 429 means slow down. 500 means the server failed — not “try hydra.”
Write a cheat strip in your notes. Quiz items will APPLY the difference between 401 and 403 on YOUR lab responses.
3. Ethics wall for “interesting” codes
Finding 401 on a stranger’s API is not homework. Finding 500 on a bank is not a CTF invite. Interesting codes on unowned hosts are out of scope.
On 127.0.0.1:8811 you may intentionally trigger 401/403/404 to learn. That is why the bind exists.
4. What you ship: a methods + status cheat strip for YOUR lab
Name GET/POST/PUT/PATCH/DELETE jobs. Name 2xx/4xx/5xx families and 401 vs 403. DEMO GATE. Dest 127.0.0.1:8811. No stranger probing.
5. What you record before the next lesson
Date. Cheat strip. DEMO identified or STOPPED. SAFE 127.0.0.1:8811. File t13-m02-l01-methods-status.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
Wrong
hydra every 401 you find on the internet. sqlmap because you saw 500. Ignore method and only read HTML.
Right
Write the alphabet. Stay on loopback. Next: curl Headers on YOUR Lab.
Mission: name verbs and codes before tooling
1) / STOP if router. 2) Write methods + status cheat strip. 3) Name 127.0.0.1:8811 as Module 2 dest. Never brute-force 401s on strangers.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Hint only: 401 vs 403?” — not how to bypass a login on a live site.
Knowledge Check
APPLY: YOUR lab returns 401 for /secret without a token. Best reading?
Multiple choice
Knowledge Check
APPLY: True or False: GET must never change server state in a healthy REST contract.
True or False
Knowledge Check
APPLY: Module 2 teaching port is:
Multiple choice