When issuing an HTTP DELETE request, the request URI should completely identify the resource to delete. However, is it allowable to add extra meta-data as part of the entity
Roy Fielding on the HTTP mailing list clarifies that on the http mailing list https://lists.w3.org/Archives/Public/ietf-http-wg/2020JanMar/0123.html and says:
GET/DELETE body are absolutely forbidden to have any impact whatsoever on the processing or interpretation of the request
This means that the body must not modify the behavior of the server. Then he adds:
aside from the necessity to read and discard the bytes received in order to maintain the message framing.
And finally the reason for not forbidding the body:
The only reason we didn't forbid sending a body is because that would lead to lazy implementations assuming no body would be sent.
So while clients can send the payload body, servers should drop it and APIs should not define a semantic for the payload body on those requests.