I have a API to allow players to "explore" a region, which randomly returns a resource. Such action would cost some game currency, so the player information is updated as a result. Because the client uses this API to "get" some resource, it's natural to think that it should be an HTTP GET. However, a GET should be idempotent, and this is not. According to RFC 7231:
The POST method requests that the target resource process the representation enclosed in the request according to the resource's own specific semantics.
and
The PUT method requests that the state of the target resource be created or replaced with the state defined by the representation enclosed in the request message payload.
The fact that both requests are for processing enclosed payload makes them not very suitable in my case. What should I use?