COPY
Duplicates a resource or collection from one URI to another, defined by WebDAV.
What it does
COPY duplicates a resource — or, with the right Depth header, an entire collection tree — from its current URI to a new one, specified via the Destination header rather than the request body. The original stays exactly where it was; COPY is purely additive.
Semantics
| Property | Value | Why it matters |
|---|---|---|
| Safe | No | Creates a new resource at the destination |
| Idempotent | Yes | Copying A to B twice leaves B in the same final state as copying it once |
| Cacheable | No | Not a read |
| Request body | No | The destination comes from the Destination header, not a body |
| Response body | Optional | Typically empty |
Syntax & example request
COPY /files/report.pdf HTTP/1.1
Host: dav.example.com
Destination: https://dav.example.com/files/archive/report.pdf
Overwrite: F
HTTP/1.1 201 Created
curl example
curl -X COPY https://dav.example.com/files/report.pdf \
-H "Destination: https://dav.example.com/files/archive/report.pdf" \
-H "Overwrite: F"
Common status codes returned
- 201 Created — new copy created at the destination → see 201
- 204 No Content — destination already existed and was overwritten → see 204
- 409 Conflict — destination's parent collection doesn't exist → see 409
COPY vs MOVE
| COPY | MOVE | |
|---|---|---|
| Source resource | Stays in place | Removed after the operation |
| Result | Two copies exist | One resource, relocated |
| Both use | Destination header, Overwrite header |
Same |
They're near-identical mechanically — MOVE is essentially "COPY, then DELETE the source" as an atomic operation.
Real-world usage
- WebDAV clients duplicating files/folders (copy-paste in a mounted drive)
- Backup/archival scripts copying resources into a separate collection without disturbing the original
Security considerations
The Overwrite header (T or F) controls whether COPY is allowed to clobber an existing resource at the destination — servers should default this carefully and validate that the caller has write permission at the destination path, not just read permission at the source, since COPY effectively grants a way to place content somewhere the caller might not otherwise be authorized to write directly.
FAQ
Does COPY require the destination's parent to already exist?
Yes — same rule as MKCOL. If the destination's parent collection doesn't exist, you get a 409 Conflict rather than automatic creation of intermediate directories.
What does the Overwrite header do?
It's a T (true) or F (false) flag telling the server whether it's allowed to replace an existing resource at the destination. Overwrite: F (the safer default in many clients) causes the request to fail if something's already there.
Can COPY duplicate an entire folder recursively?
Yes, when the source is a collection and the Depth header is set to infinity (the default for COPY on collections) — the server duplicates the whole subtree to the destination.
Fun fact
COPY and MOVE both route the destination through a custom Destination header rather than the request body or a second URI segment — an unusual design choice compared to most modern REST APIs, which tend to model "copy to X" as a POST with the destination in a JSON body instead.