IETF Introduces New HTTP QUERY Method for Safe Requests with Body

New HTTP Method Introduced

The Internet Engineering Task Force (IETF) released RFC 10008 in June 2026, which formally introduces the HTTP QUERY method. This marks the first addition of a new standard HTTP verb in sixteen years, with the last being PATCH in 2010. The new method was authored by Julian Reschke, James Snell, and Mike Bishop, stemming from discussions initiated at the 2019 HTTP Workshop.

Addressing Developer Challenges

The QUERY method aims to resolve long-standing issues faced by developers when handling complex data requests. While GET requests are safe and idempotent, their parameters are confined to the URL, leading to length limitations, potential data exposure in access logs, and difficulty expressing nested data structures. Conversely, POST requests can carry rich bodies but lack safety and idempotency, preventing caching and safe retries, and implying state changes to intermediaries.

Combining Benefits of GET and POST

QUERY provides a solution by allowing a request to carry a body, similar to POST, while retaining the safe, idempotent, and cacheable characteristics of a read operation. This enables developers to send complex filters or data in the request body without concerns about URL length or state modification. For example, a search query that previously required URL encoding can now send its filter as a JSON body, improving flexibility and readability.

Cacheability and Server Support

Responses to QUERY requests remain cacheable, provided that the cache key incorporates the content of the request body. Servers can indicate their support for the new method through the 'Accept-Query' field. This design ensures that the benefits of caching are maintained for these new types of requests.

Community Reception and Rationale

Discussions on platforms like r/webdev and Hacker News highlighted the need for an explicit method like QUERY. Developers pointed out that while some implementations might allow a body with GET, this is considered a 'hack' and can lead to difficult debugging scenarios if intermediaries drop the body. An explicit QUERY method ensures that supporting parties correctly handle the body, making debugging easier and standardizing behavior across the web.