[ViktorasM]

Not a security topic, but POST is not necessarily "create" and PUT is not necessarily "update".

[Mandatum]

And API's aren't necessarily REST. But this "checklist" is very clearly geared towards a "standard" set of REST APIs. So what's your point, that there are edge-cases in RESTful design?