It’s not a matter of security. The HTTP protocol defines GET-type requests as being idempotent, while POSTs may have side effects. In plain English, that means that GET is used for viewing something, without changing it, while POST is used for changing something. For example, a search page should use GET, while a form that … Read more
The PATCH method is the correct choice here as you’re updating an existing resource – the group ID. PUT should only be used if you’re replacing a resource in its entirety. Further information on partial resource modification is available in RFC 5789. Specifically, the PUT method is described as follows: Several applications extending the Hypertext … Read more
GET and POST are two different types of HTTP requests. According to Wikipedia: GET requests a representation of the specified resource. Note that GET should not be used for operations that cause side-effects, such as using it for taking actions in web applications. One reason for this is that GET may be used arbitrarily by … Read more
NOTE: When I first spent time reading about REST, idempotence was a confusing concept to try to get right. I still didn’t get it quite right in my original answer, as further comments (and Jason Hoetger’s answer) have shown. For a while, I have resisted updating this answer extensively, to avoid effectively plagiarizing Jason, but … Read more