Support

I am using the Joomla API extensively – it's how I publish our software on this site. I am of course doing POST requests. This is the HTTP method used in REST APIs to modify data which is a necessary part of the release process (a new release is first created unpublished, then its download items are created, then the release is published – all of that being POST requests).

I am of course using the .htaccess Maker; Admin Tools exists because the default level of protection in Joomla was not paranoid enough for my liking with our business site's use case in mind.

The only things I can think of are:

• Do you have any custom .htaccess code? You might've added some "security" code you found in the Joomla Forum, a Joomla Facebook group, or some other similarly unreliable source. A lot of people, especially around 2-3 years ago, were posting idiotic .htaccess code to disable the Joomla API's POST and PUT method because of a security issue that had long been resolved. Panic spreads like wildfire amongst those who don't understand what they're doing.
• Do you have Force HTTPS for these URLs or HSTS Header enabled? If so, make sure that you always access your API using the HTTPS protocol. Otherwise you get a redirection from plain HTTP to HTTPS which will break the request. It shouldn't cause a 405 Method Not Allowed, but you never know.
• Do you have Redirect www and non-www addresses enabled, or have set Redirect this (old) domain name to the new one? Basically the same as above. These will cause redirects unless you use the exact domain name (note that example.com and www.example.com are two different Fully Qualified Domains!).

Given the HTTP 405 I am pretty darn sure you are using some custom .htaccess code which blocks the Joomla API. The really bad (both as an idea, and as an execution) .htaccess code I had seen a couple of years ago that was blocking the Joomla JSON API would indeed let GET requests through and only block all other verbs. Completely idiotic, as it wouldn't address the security issue if it existed (a GET request could've exposed private information), the issue was already fixed weeks before that code started floating around, and if someone really wanted to disable the Joomla API they could just unpublish all webservices plugins.