Curl OPTIONS Request Example

The command

curl -i -X OPTIONS https://httpbin.org/get

Opens the request console with this request filled in. It is sent from api-tester.com's server rather than from your machine, so it shows what the endpoint returns, not how your own network or curl build behaves.

What the flags do

Flag	What it does
`-X OPTIONS`	Set the method.
`-i`	Show response headers, which is where the whole answer is.
`--request-target "*"`	Ask about the server as a whole instead of one path (curl 7.55+).

Reading the Allow header

A plain OPTIONS response normally has no body. The answer is the Allow header, a comma-separated list such as GET, HEAD, OPTIONS. It is the quickest way to find out why a 405 Method Not Allowed happened: the method you tried will be missing from the list.

curl -s -i -X OPTIONS https://httpbin.org/get | grep -i "^allow"

Reproducing a CORS preflight

Before a browser sends a cross-origin request that is not "simple" (a PUT, or a POST with a JSON body, or anything with a custom header) it first sends an OPTIONS request describing what it intends to do. You can send exactly that with curl and read the server's verdict.

The request succeeds for the browser only if the response is a 2xx and Access-Control-Allow-Origin matches the origin, Access-Control-Allow-Methods includes the method, and Access-Control-Allow-Headers covers every header named.

curl -i -X OPTIONS https://httpbin.org/post \
  -H "Origin: https://app.example.com" \
  -H "Access-Control-Request-Method: POST" \
  -H "Access-Control-Request-Headers: content-type, authorization"

Common mistakes

An application that requires auth on OPTIONS breaks CORS. Browsers never send credentials on a preflight, so a 401 there fails every cross-origin call.
Without the Origin header many servers skip their CORS logic and answer as if it were a plain OPTIONS.
A missing Allow header is common. Plenty of frameworks answer OPTIONS with 200 or 204 and no method list at all.

Related curl examples

Curl CORS Request Example

Curl cannot have a CORS error.

Curl HEAD Request Example

HEAD asks for the headers a GET would return and nothing else.

Curl Send Header Example

-H adds a header line to the request.

Curl DELETE Request Example

Deleting with curl is one flag.

All Curl Examples

49 worked examples, grouped by what you are trying to do.

More under Methods

References

curl man page: -X — Setting a custom request method.
MDN: OPTIONS — The Allow header and the preflight use of the method.

These links leave api-tester.com, which is independent of the projects they point to.

FAQ

How do I send an OPTIONS request with curl?

Use curl -i -X OPTIONS followed by the URL. The -i flag matters because the result is in the response headers, not the body.

How do I check which HTTP methods a URL allows?

Send an OPTIONS request and read the Allow response header, which lists the supported methods.

How do I test a CORS preflight with curl?

Send an OPTIONS request with Origin, Access-Control-Request-Method and, if needed, Access-Control-Request-Headers, then inspect the Access-Control-Allow-* headers in the response.