Isn't that fairly straightforward? PUT for full updates and PATCH for partial ones. Does anybody do anything different?

PUT for partial updates, yes, constantly. What i worked with last week: https://docs.gitlab.com/api/projects/#edit-a-project

That's straightforwardly 'correct' and Fielding's thesis, yes. Yes people do things differently!

Lots of people make PUTs that work like PATCHes and it drives me crazy. Same with people who use POST to retrieve information.

Well you can't reliably use GET with bodies. There is the proposed SEARCH but using custom methods also might not work everywhere.

No, QUERY. https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-saf...

SEARCH is from RFC 5323 (WebDAV).

The SEARCH verb draft was superseded by the QUERY verb draft last I checked. QUERY is somewhat more adopted, though it's still very new.

  POST /gql
  "Get thing"
  ...
  200
  "Permission denied to get thing"

Hate it.

These verbs dont even make sense most of the time.

You sweet summer child.

It's always better to use GET/POST exclusively. The verb mapping was theoretical from someone who didn't have to implement. I've long ago caved to the reality of the web's limited support for most of the other verbs.

Agreed... in most large (non trivial systems) REST ends up looking/devolving closer to RPC more and more and you end up just using get and post for most things and end up with a REST-ISH-RPC system in practice.

REST purists will not be happy, but that's reality.

What is the limited support for CONNECT/HEAD/OPTIONS/PUT/DELETE ?

It was limited up until the last 10 years, and if someone hasn't updated their knowledge then it's still limited, I suppose.

XMLHttpRequest? fetch?

We're talking JSON APIs -- HTML forms are incompatible with that no matter the verb.

Fetch came in around 2015, and XMLHttpRequest wasn't consistent in the way different verbs were handled, like redirects, as this blog post[0] from 2006 points out:

> Basic redirect support is pretty universal, but things quickly fall apart on most browsers when you do tricky things like use non-GET/POST methods on redirecting resources.

There were other things too, I'm not sure CORS supported anything but GET and POST early on either. Wanting consistency and then sticking to it isn't an inherently bad thing, there's a lot to know, and people don't update knowledge about everything (I'm speaking generally as well as including my self here).

[0] https://www.mnot.net/blog/2006/01/23/test_xmlhttprequest

> I've long ago caved to the reality of the web's limited support for most of the other verbs.

Sounds like this reality is not the recent one.