OPTIONS Request

How it works

An OPTIONS request asks a server what it supports at a URI without performing any action. The answer comes back in headers: Allow lists the HTTP methods the resource accepts, and browsers send the same verb as a CORS preflight to read headers such as Access-Control-Allow-Methods before a cross-origin call.

testkru handles OPTIONS before it routes the request, so it answers 200 with an empty body and the same Allow value on every path, /users and /products/1 alike. It also sets Access-Control-Allow-Methods to the identical list. That is a sandbox shortcut: a stricter server would list only what each path supports.

REST Assured sends the verb with options(). Since the information lives in headers, you read it with getHeader() on the Response, or header(), which does the same. Header lookups ignore case, so asking for allow in lower case returns the same string.

About the assignment

Ask /users which methods it allows and print the status together with the raw Allow header value.

What you will do

1. 1Send an OPTIONS request to /users with given() and options().
2. 2Print the status code after Status:.
3. 3Read the Allow response header with getHeader().
4. 4Print that value after the label Allow:, exactly as the server sent it.

Common mistakes

• Looking for the methods in the body

  The body of this OPTIONS response is empty, so jsonPath() has nothing to parse. Everything you need is in the headers.

• Comparing the header as a list

  getHeader() returns one String with comma-separated values. To check a single method, use containsString() or split the string. Comparing it with a Java list never matches.

• Trusting OPTIONS as the source of truth

  Because this server returns one list for every path, the header says DELETE is allowed on /users itself, yet only /users/1 style paths have a DELETE route. Confirm a method by calling it.

In a real test suite

Related lessons

• HEAD RequestHEAD is the other metadata-only verb, returning headers without a body.
• Custom Response HeadersReads several named response headers with getHeader().
• Delete a UserActually uses one of the listed methods, DELETE, on a single user.

To try one of these calls on any API endpoint without a task, open the Online Selenium Java Compiler (REST Assured is included).

Starter code

The editor above opens with this code. Fill in the TODO lines, then run and submit it.

import io.restassured.RestAssured;
import io.restassured.response.Response;
import io.restassured.specification.RequestSpecification;
import static io.restassured.RestAssured.*;

public class Main {
    public static void main(String[] args) {
        RestAssured.baseURI = "https://testkru.com/api";

        // TODO: Send OPTIONS request to /users
        // TODO: Print the status code
        // TODO: Print the "Allow" response header using response.getHeader("Allow")
    }
}