Why am I getting a 404 when trying to post a comment?

Question

I'm dabbling around in /posts/{id}/comments/add, and I'm trying this query:

https://api.stackexchange.com/2.1/posts/144890/comments/add?site=meta.stackover‌​flow&key=ArbQthisismykeyjyecuJQ((&access_token=2YVSaccesstokenomg))&body=and%20th‌​is%20is%20another%20test

It's giving me a 404:

{"error_name":"no_method","error_message":"this method cannot be called this way","error_id":404}

What am I doing wrong? I can perform the action just fine from the doc page, but I can't from the API itself.

Answer 1

HTTP GET

$.get("https://api.stackexchange.com/2.1/posts/144890/comments/add?site=meta.stackoverflow&key=ArbQjyecuJQ((&access_token=2YVSaccesstokenomg))&body=Another%20API%20test", console.log)

{"error_name": "no_method", "error_message": "this method cannot be called this way", "error_id": 404}

HTTP POST

$.post("https://api.stackexchange.com/2.1/posts/144890/comments/add?site=meta.stackoverflow&key=ArbQjyecuJQ((&access_token=2YVSaccesstokenomg))&body=Another%20API%20test", console.log)

{"error_name": "bad_parameter", "error_message": "`key` doesn't match a known application", "error_id": 400}.

Ignoring the key error (presumably you put an invalid one in the post on purpose, and you have a real one stashed somewhere), Brock Adams' comment appears correct - this API path must be requested using a POST. Which makes a whole pile of sense, as GETs are defined as safe and idempotent operations, while POSTs are neither; and the adding of a comment is neither.

URIs, Addressability, and the use of HTTP GET and POST

§3

In [section 9.1.1], HTTP/1.1 states, the convention is that GET is used for safe interactions and SHOULD NOT have the significance of taking an action other than retrieval. Indeed, if you use GET for interactions with side-effects, your make your system insecure. For example, a malicious Web page publisher outside a firewall might put a URI in an HTML page so that, when someone inside the firewall unwittingly follows the link, that person activates a function on another system within the firewall.

Users accept obligations through other mechanisms than requests to follow a link. Per the HTTP/1.1 specification, designers should use HTTP POST for those interactions.

RFC 2616: HTTP/1.1

§9.1.1

...In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe"...

§9.1.2

Methods can also have the property of "idempotence" in that (aside from error or expiration issues) the side-effects of N > 0 identical requests is the same as for a single request.

The only real problem here is that this is not mentioned anywhere in the Stack Exchange API documentation; I've opened a bug report.