It seems that throwing a MethodNotAllowedException does not result in a 405 status code in the response. here is an example of the output when attempting an OPTIONS request on a controller without that method implemented:
HTTP/1.1 500 Internal Server Error
Date: Thu, 12 Nov 2020 06:49:36 GMT
Server: Apache/2.4.46 (Ubuntu)
Content-Length: 105
Connection: close
Content-Type: application/json
{
"status": 500,
"error": 0,
"message": "Method 'OPTIONS' is not allowed by this endpoint."
}
It is unclear where this is getting caught and why the HTTP status code set in MethodNotAllowedException is getting ignored. The most likely culprit is a catch {} clause that has an incorrect namespace for the AbstractApiException class.