That's basically right. I view GET/PUT/PATCH/DELETE/CREATE as simple wrappers around SQL commands, with validation and authorization checks. POST is a call to

That's basically right. I view GET/PUT/PATCH/DELETE/CREATE as simple wrappers around SQL commands, with validation and authorization checks. POST is a call to do something with that data, which might include changing the data. Off the top of my head, logging in, actions with external systems, sending emails.