The HTTP QUERY method is now a standard

The IETF published RFC 10008, “The HTTP QUERY Method,” as a Proposed Standard on 15 June 2026. The document is the finished form of draft-ietf-httpbis-safe-method-w-body. IANA has registered QUERY as a safe, idempotent HTTP method.

That status matters because the web has needed this method for a long time. QUERY fills the gap between GET and POST for reads whose input is too large, too structured, or too sensitive to put in a URL.

What QUERY is

A QUERY asks the target resource to process the request content in a safe and idempotent way, then return the result. The content and its Content-Type define the query. The target URI still identifies the resource being queried.

A short example looks like this:

QUERY /feed HTTP/1.1
Host: example.org
Content-Type: application/x-www-form-urlencoded

q=foo&limit=10&sort=-published

The RFC notes that queries this short are often better sent with GET. QUERY is for the cases where the URI is the wrong place to put the input. Servers must fail a request if Content-Type is missing or does not match the body. Clients can discover support with OPTIONS and the Allow header. The Accept-Query response header advertises the query formats a resource accepts.

Why it is good

GET is safe, idempotent, and easy to cache, but it has no defined semantics for a request body. Putting a large or structured query into the URI runs into length limits (RFC 9110 recommends support for at least 8000 octets, and many systems are stricter), awkward encoding, and exposure: URIs are more likely to be logged, bookmarked, or copied than request content.

POST can carry a body, but it does not tell intermediaries that the request is a repeatable read. Intermediaries cannot assume it is safe to retry, and a POST response is cacheable only for later GET or HEAD requests.

QUERY gives you both sides of that trade. It is explicitly safe and idempotent, so a client can retry after a connection failure without asking the target resource to change state. It carries the query in the body, so you are not bound by URL length, and sensitive filters are less likely to appear in logs or bookmarks. The response is cacheable for later QUERY requests, with the request body included in the cache key, so two different queries to the same URL are not treated as the same entry. A server can also assign a Location or Content-Location URI so later clients can follow up with an ordinary GET.

The intent is clearer for people and for tools. OpenAPI 3.2, released on 19 September 2025, already has a native query operation, so an API can describe a body-bearing search as a query rather than as a disguised POST.

What works today

You can send or serve QUERY in more places than many people expect. curl accepts curl -d "..." -X QUERY. If you also follow redirects, use --follow (added in curl 8.16.0) rather than -L, so 301 and 302 keep the QUERY instead of turning it into a GET.

MDN documents fetch() as the way to issue QUERY in a browser. There is no HTML form support, and a cross-origin QUERY triggers a CORS preflight, which is also what the RFC expects.

On the server side, Express 5 provides app.query() (on Node.js 20.19.3 and later, excluding 21, or 22.2.0 and later). Fastify lists QUERY among supported methods and provides fastify.query(). .NET 10 has HttpMethod.Query. Netty 4.1 defines HttpMethod.QUERY. Envoy 1.40.0 accepts QUERY on HTTP/1 and rejects a QUERY that lacks Content-Type. Cloudflare Workers accept all HTTP methods except CONNECT, so a Worker can handle request.method === "QUERY" and read the body.

Go already accepts the method as a string. The http.MethodQuery constant is on Go’s master branch for the 1.28 development cycle; it is not in Go 1.27.

Keep a POST fallback until the caches and proxies on your path honor a body-aware cache key. QUERY is the right method for a safe query with a body, and it is ready to offer alongside the methods you already support.