HTTP QUERY Method (RFC 10008) — The New HTTP Method Every Developer Should Know

If you have ever built a search or filter endpoint and sat there wondering — "should I use GET or POST for this?" — you are not alone. It is one of those decisions that never felt completely clean either way. GET has URL length problems. POST has the wrong semantics. You pick the lesser evil and move on.

Well, that tradeoff just got a proper solution. In June 2026, the IETF officially published RFC 10008 — a brand new HTTP method called QUERY. It is the first new standardised HTTP method in years, and it directly fixes a gap that developers have been quietly working around since HTTP was born.

Let me walk you through exactly what it does, why it matters, and whether you should start using it today.

The Problem With GET

When you want to fetch data from a server, GET is the correct HTTP method. It is safe, idempotent, and cacheable — all the right properties for a read operation. The problem shows up the moment your query gets even slightly complex.

Simple queries are fine:

GET /api/users?role=admin&status=active HTTP/1.1
Host: example.com

But real world search endpoints are never that simple. Nested filters, date ranges, sorting options, pagination — all of it has to live in the URL. It quickly turns into something like this:

GET /api/products?filter[and][0][price][lt]=500&filter[and][1][category]=electronics&filter[or][0][inStock]=true&filter[or][1][onSale]=true&sort[0][field]=price&sort[0][direction]=asc&page=2&limit=20 HTTP/1.1
Host: example.com

That URL is almost unreadable. And there is a bigger technical problem — URLs have length limits. Browsers cap somewhere between 2,000 and 8,000 characters depending on the implementation. Proxies, CDNs, and load balancers often have their own limits too, and they are inconsistent. Go beyond those limits and your request silently fails or gets truncated in ways that are very difficult to debug.

Structured data like arrays and nested objects also do not encode into URLs cleanly. There is no universal standard for how to represent ?roles[]=admin&roles[]=editor versus ?roles[0]=admin&roles[1]=editor versus ?roles=admin,editor. Every framework handles it differently.

Why POST Is Not the Answer Either

Most developers solve the GET problem by switching to POST. You send a proper JSON body, no length limits, clean structure. It works — but it comes with a cost that is easy to overlook until it bites you.

POST is defined in the HTTP specification as non-safe and non-idempotent. It is intended for operations that create or change state on the server. When you use POST for a search that reads data and changes absolutely nothing, you are technically lying to every HTTP component in the chain. The practical consequences are:

• No caching — HTTP caches treat POST responses as non-cacheable by default. That same search query made a thousand times hits your server a thousand times. GET responses get cached automatically. POST responses do not.
• No automatic retries — HTTP clients and load balancers will not automatically retry a failed POST because they cannot safely assume nothing happened on the server. A failed GET is retried. A failed POST is not.
• Wrong semantics — POST /search looks like it is creating a search resource. New developers reading the code, API documentation tools, and monitoring systems all treat it as a write operation. The intent is hidden.

What Is the HTTP QUERY Method?

The new QUERY method is exactly what the name suggests — a dedicated HTTP method for query operations. The simplest way to understand it:

QUERY = POST's body + GET's safety guarantees

It carries a request body just like POST, so you can send complex structured queries without worrying about URL length. But unlike POST, it is explicitly declared as safe and idempotent in the IANA HTTP Method Registry — meaning every client, proxy, cache, and CDN in the chain knows this operation is read-only, can be safely retried, and its response can be cached.

Here is what a basic QUERY request looks like:

QUERY /api/products HTTP/1.1
Host: example.com
Content-Type: application/json
Accept: application/json

{
  "filters": {
    "category": "electronics",
    "price": { "lt": 500 },
    "inStock": true
  },
  "sort": {
    "field": "price",
    "direction": "asc"
  },
  "page": 1,
  "limit": 20
}

And the server responds normally:

HTTP/1.1 200 OK
Content-Type: application/json
Accept-Query: "application/json"

{
  "total": 142,
  "page": 1,
  "results": [ ... ]
}

Clean, readable, and semantically honest. The method name alone tells every component in the chain exactly what is happening. No guessing, no workarounds.

Key Properties of QUERY

1. Safe and Idempotent — Built Into the Protocol

Safety and idempotency are not just labels in a README. Because QUERY is registered in the IANA HTTP Method Registry with these properties, any generic HTTP client, proxy, or cache can treat it correctly without knowing anything about your specific API. Previously, when you used POST for search, you had to document somewhere that this POST was safe to retry. With QUERY, that guarantee is encoded directly into the protocol itself — no documentation required.

2. Cacheable Responses

QUERY responses can be cached just like GET responses. The important difference is that the cache key must include both the request URL and the request body — since two QUERY requests to the same URL but with different bodies are different queries. As long as your cache infrastructure handles this correctly, repeated identical queries can be served from cache without ever hitting your server.

3. The Accept-Query Response Header

RFC 10008 introduces a new response header called Accept-Query. Servers use it to advertise which query formats they support:

HTTP/1.1 200 OK
Content-Type: application/json
Accept-Query: "application/json", "application/jsonpath"

A client can read this header to discover whether an endpoint supports QUERY at all, and which content types are valid for the request body. This is particularly useful for API discovery and documentation tools.

4. Stored Query Results

One of the more clever features in the specification is the ability for a server to assign a permanent URI to a query result. The server can return a Content-Location header pointing to where the result is stored:

// Initial QUERY request with full body
QUERY /api/reports HTTP/1.1
Host: example.com
Content-Type: application/json

{
  "year": 2026,
  "region": "asia",
  "metric": "revenue"
}

// Server assigns a URI to the result
HTTP/1.1 200 OK
Content-Type: application/json
Content-Location: /api/reports/results/abc123

{ ...result data... }

// Future requests — no body needed, just a plain GET
GET /api/reports/results/abc123 HTTP/1.1
Host: example.com

This is very useful for expensive queries — run it once with QUERY, get back a stable URL, then serve all future requests for that result as a simple GET that can be fully cached by any CDN.

5. Redirect Behaviour

The RFC defines how redirects work with QUERY specifically. For 301, 302, 307, and 308 responses, the client repeats the QUERY request at the new location — the body is preserved. For a 303 See Other response, the result can be retrieved with a plain GET. Importantly, the old browser behaviour of silently converting a POST into a GET after a redirect does not apply to QUERY.

QUERY vs GET vs POST — Full Comparison

Who Benefits Most From QUERY?

GraphQL APIs

GraphQL has lived with the POST problem for years. Every GraphQL operation — including read-only queries that touch no mutable state — routes through POST. The result is that GraphQL queries lose HTTP-level caching entirely, forcing developers to build workarounds like persisted queries just to recover something GET already had for free. With QUERY now standardised, the GraphQL Foundation has a clean path to route query operations through QUERY instead of POST, restoring proper caching and retry semantics without any changes to the query language itself.

Complex REST Search Endpoints

Any REST API that has a search or filter endpoint with more than a few parameters is a candidate. E-commerce product search, user filtering with multiple criteria, report generation with complex date and dimension options — all of these hit the GET URL limit problem eventually.

Service-to-Service Communication

For internal APIs where you control both the client and server, QUERY can be adopted today without waiting for browser support. Microservices talking to each other over HTTP are the first practical use case where QUERY is ready to use right now.

Should You Start Using QUERY Right Now?

Honest answer — not in public-facing production APIs yet, but watch this space closely. Here is the realistic picture:

• Browser fetch() support — not yet. You cannot send a QUERY request from fetch() or XMLHttpRequest in browsers today. This is the biggest blocker for frontend-facing APIs.
• CDN and proxy support — coming soon. Cloudflare and Akamai co-authored RFC 10008 — their involvement is not accidental. CDN-level caching support for QUERY is likely coming ahead of most other tooling.
• Framework support — early but growing. .NET 10 (released November 2025) already has built-in QUERY support on both client and server. Most other frameworks require manual handling for now but it is straightforward to add.
• curl and API clients — already working. Tools like curl support custom HTTP methods today, so you can test QUERY endpoints right now without any extra setup.

# Testing a QUERY endpoint with curl right now
curl -X QUERY https://api.example.com/products \
  -H "Content-Type: application/json" \
  -d '{"filters": {"category": "electronics"}, "limit": 10}'

A Word on Adoption

The publication of an RFC does not mean instant support everywhere. HTTP took years to get widespread HTTPS adoption. PATCH took years to be properly supported across frameworks after RFC 5789 was published. QUERY will follow the same path — gradual, starting from controlled environments and moving outward as browser vendors, CDNs, and framework maintainers add support.

The spec is final. The semantics are nailed down. What remains is ecosystem catch-up — and given that Cloudflare and Akamai are already involved, that catch-up may come faster than previous HTTP method additions.

Final Thought

QUERY does not make something possible that was previously impossible. Developers have been sending complex query bodies for years — they just had to use POST and live with the semantic mismatch. What RFC 10008 does is make the intent explicit at the protocol level, so caches, proxies, monitoring tools, documentation generators, and every other piece of HTTP infrastructure can understand and respect it automatically.

That is the real value here. Not a new capability — a proper home for something we were already doing.

Keep an eye on your framework's changelog. When QUERY support lands, you will know exactly what to do with it.

Have thoughts on this or already experimenting with QUERY in your stack? Drop a message on our contact page — always happy to hear how developers are using new specs in the real world.