Choose a method deliberately

You rarely tell curl which HTTP method to use. Some curl options imply one. A plain URL produces GET. --data implies POST, because sending a body is what POST is for. --head requests headers through HEAD. --upload-file implies PUT. Each option switches the method because the method matches what the option does.

Then there’s --request (short form -X). It changes the method string but does not add the behavior normally associated with that method. It swaps one word in the request line and nothing else.

See the difference

Compare a HEAD request with an explicit method:

curl --head https://example.org/
curl --request DELETE https://httpbin.org/anything

The first transfer expects no response body. That’s real behavior: curl knows HEAD responses carry headers only, so it prints them and doesn’t wait for content.

The second sends DELETE, and httpbin’s echo confirms it:

{
  "method": "DELETE",
  "data": "",
  "json": null
}

But curl does not invent authentication, a JSON body, or application semantics. It sent an ordinary request whose method token happens to say DELETE. Whether anything gets deleted is entirely the server’s decision.

Where -X goes wrong

The classic mistake is -X GET combined with --data. The request line says GET, but a body still goes out, because -X only renames the method. Some servers ignore bodies on GET, others reject them. If you want a GET with data in the URL, the right tool is --get with the data options, not -X.

My advice: reach for -X only when the API genuinely requires a method curl has no native option for, like DELETE or PATCH. Let curl’s own options pick the method everywhere else, because they adjust the rest of the request to match.

Use the method required by the API contract, and be careful with the destructive ones. A successful connection does not mean a destructive method is authorized or safe. Point DELETE at test endpoints like httpbin.org/anything until you’ve read what the real API does with it.