ASP.NET Core: '405 Method Not Allowed' and the Allow header

HTTP/1.1 405 Method Not Allowed from ASP.NET Core means the URL exists but is not mapped for the HTTP verb you used. The response's Allow header names the verbs the route does accept; either call it with one of those, or map the verb you need.

In the test a POST to a route mapped with MapGet returned 405 with Allow: GET, and the same URL with GET returned 200.

The error

curl.exe -s -D - -X POST -H "Content-Type: application/json" -d "@body.json" http://127.0.0.1:15708/orders
HTTP/1.1 405 Method Not Allowed
Content-Length: 0
Date: Fri, 06 Nov 2026 07:50:32 GMT
Server: Kestrel
Allow: GET

That is the complete response, with no body. The server's console log had no line for this request, so the Allow header is the only clue. With curl, -D - prints the response headers next to the body.

Why it happens

The app mapped these two endpoints:

app.MapPost("/patients", (Patient p) => Results.Ok(p));
app.MapGet("/orders", () => new[] { "A-1001", "A-1002" });

/orders is mapped for GET only. A POST to /orders matched the path but not the verb, so routing answered 405 and listed the verbs it had for that path in Allow. For comparison, the same POST to /invoices, a path that is not mapped at all, answered 404 Not Found. So 405 says "right URL, wrong verb" and 404 says "no such URL". In this sample the POST handler lives on /patients, so a client posting to /orders had the wrong URL for what it wanted to do.

The fix

Call the route with the verb in the Allow header:

curl.exe -s -D - http://127.0.0.1:15708/orders
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Date: Fri, 06 Nov 2026 07:50:32 GMT
Server: Kestrel
Transfer-Encoding: chunked

["A-1001","A-1002"]

If the client is right and the server should accept the verb, map it on the server for the same path:

app.MapGet("/orders", () => new[] { "A-1001", "A-1002" });
app.MapPost("/orders", (Patient p) => Results.Created("/orders/A-1003", p));

curl.exe -s -D - -X POST -H "Content-Type: application/json" -d "@body.json" http://127.0.0.1:15723/orders
HTTP/1.1 201 Created
Content-Type: application/json; charset=utf-8
Date: Fri, 06 Nov 2026 07:59:21 GMT
Server: Kestrel
Location: /orders/A-1003
Transfer-Encoding: chunked

{"name":"Maria Garcia","email":"maria@example.test"}

The same POST that got 405 now got 201 Created, and the GET on /orders stays mapped beside it. Read the Allow header first, because it tells you which side to change.

How it was reproduced

A dotnet new web project (net10.0) with the two endpoints above, run in the Production environment on http://127.0.0.1:15708 and called with curl 8.21.0; the POST body was a small JSON file with fictional data. .NET SDK 10.0.403, Microsoft.AspNetCore.App 10.0.14, Windows 11.

Frequently asked

What does 405 Method Not Allowed mean in ASP.NET Core?

The path exists but is not mapped for the HTTP verb you used. In the test a POST to a GET-only route returned 405 with an Allow: GET header.

How do I see which methods an endpoint allows?

Read the Allow header of the 405 response. With curl, add -D - to print the headers; in the test the header was Allow: GET.

How do I fix 405 on an ASP.NET Core minimal API?

Call the route with a verb from the Allow header, or map the missing verb on the server, for example with MapPost for the same path. In the test, calling /orders with GET returned 200.

More decoded errors in the Fixes category, including 415 Unsupported Media Type, the status you get when the verb is right but the body's content type is not.