The IETF published RFC 10008 in June 2026, giving HTTP its first new standard method since PATCH arrived in 2010. The new method is called QUERY, and it solves a problem developers have been working around for years: how to send a rich request body for a read operation without losing the safe, idempotent, and cacheable semantics that GET provides.

QUERY is not a replacement for GET or POST. It is an optional addition that fills a specific gap. GET is safe and idempotent, but its parameters live in the URL, where they hit length limits, leak into access logs, and cannot express nested structures without ugly encoding tricks. POST can carry a rich body, but it is neither safe nor idempotent, so caches skip it, clients cannot safely retry it, and intermediaries must assume it changes state. QUERY does what neither can: it carries a body like POST while preserving the read-only semantics of GET.

What QUERY actually looks like in practice

Consider a search endpoint that filters orders by email, limits results to ten, and uses a wildcard match. In the current world, you squeeze all of that into a URL query string:

GET /orders?select=email&limit=10&match="email=*@example.*"

With QUERY, the same request sends its filter in the body, where size is not a concern and nested structures are natural:

QUERY /orders HTTP/1.1
Host: api.example.org
Content-Type: application/json

{
  "select": ["email"],
  "limit": 10,
  "match": "email=*@example.*"
}

The response stays cacheable as long as the cache key incorporates the request content. Servers can advertise support through a new Accept-Query response header, letting clients know the endpoint accepts QUERY before they try it. The IETF specification advises treating QUERY as additive rather than a wholesale replacement for GET and POST.

Why not just add an optional body to GET?

This question dominated discussion on r/webdev, where the thread drew more than 800 upvotes, and on Hacker News. The argument for adding an optional body to GET seems simple: it already works in practice, so why introduce a new method?

The answers are practical, not theoretical. A new method forces an explicit contract between client and server. If a server does not support QUERY, it responds with "QUERY not supported" and the client knows immediately. If you send a body on GET and the server ignores it, the failure is silent. Debugging which server in the chain dropped your body becomes a nightmare of proxy configurations and middleware behavior.

The HTTP specification explicitly discourages GET with a body. RFC 9110 says GET should not have a significant body, and intermediaries are within their rights to strip or ignore it. That means using GET with a body is a hack that depends on every proxy, load balancer, and CDN in the path behaving the same way. QUERY gives you a method designed for this use case, with explicit semantics that intermediaries can understand and respect.

One Hacker News commenter summarized the core issue: using GET with a body works, but just because something works does not mean it is the right way to do it. The method exists to communicate intent, and the intent of GET is to retrieve data without side effects. QUERY communicates a different intent: retrieve data using a complex query that requires a body.

GraphQL and Elasticsearch already need this

GraphQL sends every request as a POST, even reads, because queries can be arbitrarily large and complex. Elasticsearch does the same for search requests that do not fit in a URL. Both technologies tunnel complex reads through POST bodies because GET cannot handle them, and both lose cacheability as a result.

QUERY offers a standards-based alternative that keeps those reads cacheable. A GraphQL endpoint that accepts QUERY instead of POST for queries can be cached by any HTTP-compliant cache, provided the cache key includes the request body. This does not require changing GraphQL itself. It requires changing the HTTP method from POST to QUERY, which is a one-line change in most server frameworks.

The same applies to Elasticsearch. Search requests sent via QUERY would be cacheable by default, which is a meaningful performance improvement for workloads with repeated queries. Elasticsearch already supports conditional requests and ETags, so adding QUERY support would layer naturally onto the existing infrastructure.

Cloudflare is already faking it

Cloudflare's current approach to caching POST requests reveals the problem QUERY solves. Their unofficial support for caching POST responses involves creating a fake GET request to serve as a cache key, then using that key to store and retrieve the response. This is a workaround that works but requires Cloudflare-specific logic and does not generalize to other CDN or cache implementations.

With QUERY, the caching behavior is standardized. Any HTTP-compliant cache that understands QUERY can cache its responses without vendor-specific hacks. The cache key includes the request body, which means two QUERY requests with different bodies produce different cache entries. This is the behavior developers want from POST caching today but cannot get without platform-specific configuration.

Tooling is catching up

The Rust http crate has already merged QUERY support. The .NET, Axum, Quarkus, and Bruno projects are tracking it. These are early days, and the IETF draft history records a long path from the earlier safe-method-with-a-body work to the standard shipping today. RFC 10008 positions QUERY as an optional addition alongside GET and POST rather than a replacement for either, which means existing applications do not need to change.

The specification was authored by Julian Reschke, James Snell, and Mike Bishop after a conversation that Asbjørn Ulsberg reopened at the 2019 HTTP Workshop. The seven-year timeline from workshop discussion to published RFC reflects the IETF's deliberate approach to HTTP changes. New methods are rare because each one has to be understood by clients, servers, proxies, and caches before it becomes dependable in practice.

What this means for API design

QUERY does not change how you build APIs today. It gives you a better option for a specific class of problems: complex read operations that need a body but should remain safe and cacheable. If your API already uses GET for simple reads and POST for complex queries, QUERY lets you move those complex queries out of POST without losing anything.

The adoption timeline will be long. PATCH took years to become ubiquitous, and QUERY faces the same challenge. But the specification is clean, the use case is clear, and the tooling is moving. For developers who have been fighting URL length limits or watching their POST-based reads get skipped by caches, QUERY is the standard solution that has been missing for years.