That's actually really correct in the most wrong way possible. I've worked with one too many endpoints that don't care about UPDATE, DELETE, and whatever else beside POST exists, while relying on body data to do the "what department are you looking for" requests.