We're having our custom dashboard that our members log into rewritten by an outsourced agency. It is being done with Angular and will use REST to call the API.
We have a particular custom API call that is giving them the error "SECURITY: All requests that modify the database must be http POST, not GET." This call does not modify the database. It composes and runs a SELECT query using CRM_Core_DAO::executeQuery.
How does the REST security mechanism determine whether a call modifies the database? If it contains handwritten queries will they just have to use a POST request?