Which cross-origin request triggers a CORS preflight?

A JSON body needs a preflight. Only three content types are allowed in simple requests: application/x-www-form-urlencoded, multipart/form-data and text/plain. application/json is not one of them. This surprises many people when their API suddenly receives OPTIONS requests.

POST with application/x-www-form-urlencoded is the tempting wrong answer. It looks like a write, but it is still a simple request, so it has no preflight. GET and HEAD with no custom headers are simple requests too.