Picture every developer who ever had to send a complex search request to a server. A really meaty one — filters, nested conditions, date ranges, maybe a SQL query or a JSONPath expression.

They looked at GET. They looked at the URL getting longer and longer, spilling sensitive filter data into browser history and server logs like someone’s private diary falling out of their bag on a bus. They thought: this cannot be right.

So they looked at POST. They put the query in the body, everything fit perfectly, all was well — except they had just lied to the entire HTTP infrastructure about what they were doing. “POST” means “change something.” They were not changing anything. They were just asking a question. With a straight face. While the CDN, the proxy, and the browser cache all agreed to never remember anything about this conversation.

This went on for about 25 years.

In June 2026, the IETF finally said: enough.

No drama. No reinventing the wheel. Just a single, thoughtful fix for a problem every backend developer has worked around so many times that most of us stopped noticing we were doing it.

Let us talk about what it is, why it took 16 years after the last new HTTP method (PATCH, 2010), and whether you should actually care about it right now.

01) First, Let’s Understand the Problem QUERY is Solving (Because It’s Actually Hilarious)

HTTP methods are supposed to be semantic. That means each one is meant to tell the server what you intend to do before you do it. GET means “give me something.” POST means “I am creating or changing something.” PUT means “I am replacing this thing.” DELETE means “goodbye, thing.”

Clean. Simple. Everyone knows what everyone is doing.

Except then search APIs showed up.

Searching for data is fundamentally a read-only operation. You want something back. You are not changing anything. You are not creating a record. You are just asking a question, ideally a complex one with lots of filters and conditions and maybe some nested logic that makes your DBA mildly uncomfortable.

GET is the correct verb for that. Read-only. Safe. Idempotent — meaning you can send it a hundred times and nothing changes on the server. Browsers and CDNs and proxies all understand GET and are perfectly happy to cache the response so the second time someone asks the same question, you do not even need to bother the server.

There is just one problem with GET.

GET cannot reliably carry a request body.

Technically, the HTTP specification does not forbid it. But it also gives GET request bodies “no defined semantics” — which in standards language is roughly equivalent to “you can do this, but do not be surprised when things get weird.” More practically, URLs cap out at somewhere between 2,000 and 8,000 characters depending on the browser. Try squeezing a complex SQL query or a GraphQL payload into a URL and you will quickly discover why this is a problem.

So developers did the next logical thing. They used POST.

🚨 The dirty secret of the web: Roughly half of all the POST requests flying around the internet right now are not actually creating or changing anything on the server. They are searches. They are read-only queries in POST clothing. They are, semantically speaking, a small lie that the entire industry collectively agreed to live with.

And the cost of that lie is real. POST responses do not get cached by default. Not by your CDN. Not by your browser. Not by any proxy in between. Because POST is “not safe” — the infrastructure cannot know whether repeating that request would accidentally create a duplicate order or deduct money from your account twice. So it just… does not cache. It asks the server every single time.

For a read-only search endpoint handling thousands of identical requests? That is an enormous waste of server resources that nobody was supposed to be burning in the first place.

02) So What Exactly Is HTTP QUERY?

QUERY is a new HTTP method that takes the best qualities of GET and the best quality of POST and combines them in a way that is so obvious in hindsight it is almost annoying.

Here is the one-sentence version: QUERY is a safe, idempotent HTTP request that can carry a body.

That is it. That is the whole thing. But let us unpack why every word in that sentence matters.

“Safe” means it does not change anything on the server

Like GET, QUERY promises it is only reading. No side effects. No records created. No database rows updated. It is just asking a question and expecting an answer. This is a contract between the client and the server, and it matters because the entire HTTP infrastructure takes this promise seriously.

“Idempotent” means you can send it multiple times and nothing changes

This is the word that sounds scary but is actually simple. Idempotent means: same request, same result, always. You can send it once or a hundred times and the server state remains identical. This is what allows proxies, CDNs, and HTTP clients to safely retry a QUERY request if the network hiccups — something they absolutely cannot do with POST, because POST might accidentally buy you eleven plane tickets if retried without care.

“Can carry a body” is the part GET could never do properly

This is where QUERY genuinely fills the gap. Your complex filter logic, your JSONPath expression, your SQL query, your GraphQL payload — all of it goes in the request body. No URL length limits. No sensitive data leaked into browser history or server access logs. Clean, structured, as large as it needs to be.

The Old Way — GET With a Nightmare URL

GET /products?category=electronics&min_price=100&max_price=5000
  &brand=samsung,apple,sony&rating_min=4&in_stock=true
  &sort=price_asc&page=1&limit=20&exclude_ids=45,67,123,456
  &color=black,silver&release_year_from=2023 ← and it just keeps going...
Host: api.example.com

The Old Workaround — POST Pretending to Be a Search

POST /products/search HTTP/1.1  ← "POST" but we're not creating anything. Shhh.


Host: api.example.com
Content-Type: application/json

{
  "filters": {
    "category": "electronics",
    "price": { "min": 100, "max": 5000 },
    "brands": ["samsung", "apple", "sony"],
    "in_stock": true
  },
  "sort": "price_asc"
}
↑ No caching. No automatic retries. Semantically incorrect. But it works. Kind of.

The Right Way — HTTP QUERY (RFC 10008)
QUERY /products HTTP/1.1
Host: api.example.com
Content-Type: application/json
Accept: application/json

{
  "filters": {
    "category": "electronics",
    "price": { "min": 100, "max": 5000 },
    "brands": ["samsung", "apple", "sony"],
    "in_stock": true
  },
  "sort": "price_asc"
}
✓ Safe. ✓ Idempotent. ✓ Cacheable. ✓ Semantically honest. ✓ Finally.

Same body as the POST version. Same endpoint logic. But now the HTTP infrastructure knows exactly what this request is — a read-only query — and can treat it accordingly.

03) The Comparison Nobody Asked For But Everyone Needed

Let us put GET, POST, and QUERY side by side so the differences are blindingly obvious:

Feature	GET	POST	Query(New)
Can carry a request body	✗ Not really	✓ Yes	✓ Yes
Safe (read-only)	✓ Yes	✗ No	✓ Yes
Idempotent	✓ Yes	✗ No	✓ Yes
Cacheable by CDNs & proxies	✓ Yes	✗ By default, no	✓ Yes (in theory — more on this below)
Auto-retryable on network failure	✓ Yes	✗ No	✓ Yes
Semantically correct for searches	⚠ Only if query fits in URL	✗ No — POST means “create”	✓ Exactly what it was designed for
Exposes data in URL / browser history	✗ Yes (everything in the URL)	✓ No (body is private)	✓ No (body is private)
Current browser support	✓ Universal	✓ Universal	⚠ Emerging — use fetch() for now

💡 Read that table again. QUERY ticks every single box that both GET and POST leave unchecked. It is not replacing them — GET and POST still do their jobs perfectly. QUERY fills the specific gap where you need a body but you are not making any changes. That gap has existed for decades and the whole industry built workarounds for it.

04) The 11-Year Journey From “Someone Should Fix This” to RFC 10008

Here is the timeline of how we got here, because it is genuinely one of the more patient stories in internet standards history:

• 2012 – 2015: Developers start complaining loudly about GraphQL and complex search APIs needing to use POST for reads. The problem is well-known. Nobody has a formal solution yet.
• 2021: The IETF HTTP working group starts seriously drafting a new method. It was briefly called SEARCH before being renamed QUERY — partly because three methods with search-like names already existed from WebDAV (PROPFIND, REPORT, SEARCH), “about which many have mixed feelings,” as the RFC puts it with delightful understatement.
• November 2025: The final draft lands. Authors: Julian Reschke (greenbytes), James Snell (Cloudflare), and Mike Bishop (Akamai). The fact that Cloudflare and Akamai — who sit in front of a huge percentage of all web traffic — co-authored this says something important about how serious this is.
• 20 November 2025: The Internet Engineering Steering Group formally approves it. This is the same approval process that produced HTTP/1.1, HTTP/2, and HTTP/3.
• 19 June 2026: RFC 10008 is published. HTTP gets its first new general-purpose method since PATCH in March 2010. The gap was 16 years. The internet quietly cheers.

📜 Fun fact from the RFC itself: Appendix B explains why they chose “QUERY” over other options with unusual honesty. The name “captures the relation with the URI’s query component well.” Translation: it does exactly what it says on the tin, which in internet standards land is apparently worth noting because it does not always happen.

05) Caching — The Part Everyone Gets Excited About (Then Slightly Disappointed About)

This is where QUERY’s promise is biggest — and also where the current reality requires a small asterisk.

Because QUERY is safe and idempotent, the HTTP specification says it can be cached. CDNs, proxies, browsers, and any caching infrastructure can see a QUERY request and say: “This is a read-only operation that produces the same result every time — I can cache this response and serve it without hitting the origin server.”

For high-traffic search endpoints, this is genuinely transformative. Imagine a product search API that gets the same filter combination sent ten thousand times a day. With POST, the server handles all ten thousand requests. With QUERY and proper caching, it handles a handful and serves the rest from cache. That is a serious performance and infrastructure cost difference.

Here is the asterisk: in mid-2026, most existing caching infrastructure has not caught up yet. CDNs that see a QUERY request may treat it as an unknown method and just pass it straight through without caching — because their code was written before QUERY existed. Cloudflare, Akamai, and other major players are working on it, but this is still emerging territory.

🧠 The smart play right now: Design your new search and filter endpoints as QUERY internally. Use explicit Cache-Control headers on your responses to instruct caches that can understand them. Offer a POST fallback for clients that do not support QUERY yet. You are building for where the infrastructure is going, not just where it is today. The tooling will catch up — and when it does, you will not need to rewrite anything.

06) Common Misconceptions — Let’s Bust Them Now Before They Spread

Myth “QUERY replaces GET and POST. I should start converting all my endpoints.”

Truth No, no, and no. GET is still the correct method for simple reads that fit in a URL. POST is still correct for creating and modifying data. QUERY fills one specific gap — read-only requests that need a body. These three methods coexist perfectly and each has its place. Do not convert existing endpoints unless you have a very good reason.

Myth “QUERY isn’t real yet — it’s just a draft.”

Truth RFC 10008 was published on June 19, 2026 as a Proposed Standard on the IETF Standards Track. The same formal process that produced HTTP/1.1, HTTP/2, and HTTP/3. It went through years of public review and IESG approval. This is as official as HTTP specifications get. It is real. It is here.

Myth “My CDN doesn’t support it, so it’s useless.”

Truth Your CDN’s current implementation not supporting something new is not the same as it being useless. It means you use explicit cache headers for now and wait for infrastructure to catch up. PATCH (2010) had the same adoption curve. Today PATCH is everywhere. QUERY will follow the same path — probably faster, because Cloudflare and Akamai literally co-authored the spec.

Myth “Using POST for reads is fine. Everyone does it. Why change now?”

Truth Using POST for reads is fine in the sense that it works. It is not fine in the sense that you are lying to the HTTP infrastructure, forfeiting all caching benefits, forfeiting automatic retries, and making your API harder to reason about. “Everyone does it” was also said about not validating user input. At some point, the better option becomes available and the right move is to use it.

07) A Quick Look at How to Actually Use QUERY in Your Code

Support is currently available in frameworks and runtimes that handle custom HTTP methods — which is most of them, because the HTTP specification allows any server to define behaviour for new methods.

JavaScript — Fetch API (Works Today)

// Standard fetch with the QUERY method
const response = await fetch('/api/products', {
  method: 'QUERY',
  headers: {
    'Content-Type': 'application/json',
    'Accept': 'application/json',
  },
  body: JSON.stringify({
    filters: {
      category: 'electronics',
      price: { min: 100, max: 5000 },
      in_stock: true
    },
    sort: 'price_asc',
    page: 1
  })
});

const products = await response.json();

Node.js / Express — Handling QUERY on the Server

// Express doesn't have app.query() — use app.use with method check
app.use('/api/products', (req, res) => {
  if (req.method === 'QUERY') {
    const filters = req.body; // Your filter payload from the request body
    // Process as a read-only search — no side effects
    const results = db.search(filters);
    res.set('Cache-Control', 'public, max-age=60'); // Tell caches it's safe
    res.json(results);
  }
});

The Accept-Query Header — Telling Clients What Formats You Support

// RFC 10008 defines Accept-Query header for servers to advertise
// which query formats they understand
HTTP/1.1 200 OK
Accept-Query: "application/json", "application/sql"
Content-Type: application/json

// This tells clients: "I can handle JSON or SQL in your QUERY body"
// Elegant. Self-documenting. The way HTTP was always supposed to work.

The realistic adoption curve:

PATCH was ratified in 2010 and took the better part of three to four years before it was in widespread, comfortable use across frameworks and tooling. QUERY will likely move faster because the problem it solves is more widely felt — every GraphQL team, every complex search API team, every reporting platform team has experienced this pain directly. But “faster than PATCH” still means measured in months to years, not weeks. Start using it on new endpoints. Do not panic-refactor existing ones.

🔧 Building an API or Web Application That Needs to Actually Perform?

At Svayambhutech, we build things properly from the start — using the right tools, the right methods, and the right architecture for what your business actually needs. React JS, Node JS, MERN Stack, API integration, RESTful and beyond. If you want a development team that knows what RFC 10008 is and why it matters for your product’s performance, we should talk. Let’s Build Something Right

The Bottom Line — And It Is a Good One

QUERY is not a revolution. It is a correction. A long-overdue, precisely targeted, carefully designed correction to something that has been slightly wrong for the better part of three decades.

The fact that it took 16 years since the last new HTTP method is not a sign of dysfunction — it is a sign of a standards body that takes its time, builds consensus carefully, and ships things that last. HTTP methods do not get updated often because they are foundational infrastructure that billions of devices rely on. When they do get updated, it sticks.

Every developer who ever typed POST /search and felt a small pang of semantic guilt — this one is for you. You were not wrong for doing it. You did not have a better option. Now you do.

Use it well.