HTTP Gets Its First New Method in 16 Years: QUERY
QUERY gives complex, body-heavy read requests a first-class HTTP citizen. It eliminates the trade-off where teams had to choose between GET's caching and safety guarantees and POST's unlimited request body, and it standardizes behavior that every framework previously had to hack around.
The IETF published RFC 10008 in June 2026, adding the QUERY method to HTTP. It is the first new method since PATCH arrived in 2010. QUERY fills the gap between GET and POST: it sends a request body like POST but carries GET's safe and idempotent semantics, meaning it is read-only and can be retried without side effects. Crucially, QUERY responses are cacheable by default, a property that POST-based query workarounds could never guarantee.
A QUERY request can also return a URI for the query itself, not just its results. That lets a complex query be bookmarked, shared, and re-executed later to fetch fresh data. API surfaces that once sprawled across many GET endpoints can collapse into a single QUERY endpoint with conditions in the body.
Browser, CDN, and framework support will take until 2027–2028 to mature, but the standard is final. API designers can start planning for it now.
The 16-year gap between PATCH and QUERY reflects how long the industry tolerated the awkward POST-for-queries pattern before standardizing a fix.
QUERY's ability to return a URI for the query itself, rather than just its results, turns a one-off request into a shareable, repeatable resource — a subtle but powerful shift for API design.
The explicit separation of idempotency from cacheability in the RFC corrects a widespread misunderstanding that has led to poor caching decisions in many APIs.