What causes "Method ${method} Not Allowed" in supabase/supabase?

Use DELETE with a JSON body containing { paths: ['path/to/file1', 'path/to/file2'] }.

Method ${method} Not Allowed

Error message

Method ${method} Not Allowed

What it means

This route removes (deletes) storage objects via supabase.storage.from(id).remove(paths) and accepts only DELETE. The paths array comes from req.body. The default case returns 405 with "Method ${method} Not Allowed" and Allow: ['DELETE']. Using POST is incorrect.

Source

Thrown at apps/studio/pages/api/platform/storage/[ref]/buckets/[id]/objects/index.ts:16

import { NextApiRequest, NextApiResponse } from 'next'

import { apiWrapper } from '@/lib/api/apiWrapper'
import { selfHostedSupabaseAdmin as supabase } from '@/lib/api/self-hosted-admin'

export default (req: NextApiRequest, res: NextApiResponse) => apiWrapper(req, res, handler)

async function handler(req: NextApiRequest, res: NextApiResponse) {
  const { method } = req

  switch (method) {
    case 'DELETE':
      return handleDelete(req, res)
    default:
      res.setHeader('Allow', ['DELETE'])
      res.status(405).json({ data: null, error: { message: `Method ${method} Not Allowed` } })
  }
}

const handleDelete = async (req: NextApiRequest, res: NextApiResponse) => {
  const { id } = req.query
  const { paths } = req.body

  const { data, error } = await supabase.storage.from(id as string).remove(paths as string[])
  if (error) {
    return res.status(400).json({ error: { message: error.message } })
  }

  return res.status(200).json(data)
}

View on GitHub (pinned to beee91b9c2)

Solutions

Use DELETE with a JSON body containing { paths: ['path/to/file1', 'path/to/file2'] }.
Do not use POST — this route only accepts DELETE for object removal.
Check the Allow: ['DELETE'] response header.

Example fix

// before — POST for bulk delete
await fetch(`/api/platform/storage/${ref}/buckets/${id}/objects`, {
  method: 'POST',
  body: JSON.stringify({ paths }),
})

// after — DELETE
await fetch(`/api/platform/storage/${ref}/buckets/${id}/objects`, {
  method: 'DELETE',
  body: JSON.stringify({ paths }),
})

Defensive patterns

Strategy: validation

Validate before calling

// Object deletion uses DELETE with body, not POST
if (method !== 'DELETE') {
  throw new Error('Object removal requires DELETE with { paths } in the body')
}

Type guard

function isObjectRemoveMethod(method: string): method is 'DELETE' {
  return method === 'DELETE'
}

Prevention

Use DELETE (not POST) for bulk object removal — paths travel in the body.
Do not confuse this with the bucket-level DELETE route.

When it happens

Trigger: Sending POST to delete objects (some APIs use POST for bulk delete). Sending GET or PUT to `/api/platform/storage/{ref}/buckets/{id}/objects`. A client assuming bulk-delete uses POST.

Common situations: Developer expecting POST for a bulk-delete action (common in some REST APIs). Confusion between this object-deletion route and the bucket-level routes. A client library that uses a different method convention for bulk operations.

Related errors

AI-assisted analysis of supabase/supabase@beee91b9c2 (2026-08-12). Data as JSON: /api/errors/4de47957f22b62ea. Report an issue: GitHub.