HTTP QUERY Method Explained: The New RFC 10008 Standard Every API Developer Needs to Know in 2026

HTTP Just Got Its First New Method in 16 Years — Here's What QUERY Actually Does

If you've spent any time building APIs, you know the core HTTP verb lineup by heart: GET, POST, PUT, PATCH, DELETE. That lineup hasn't changed since PATCH was formalized in 2010. In June 2026, that changed. The IETF published RFC 10008, standardizing a brand-new HTTP method called QUERY — and it's already generating serious buzz across backend, API, and security communities.

This isn't a minor spec update. It's the first new standard HTTP method added to the protocol in over a decade, and it solves a problem nearly every API developer has quietly worked around for years.

The Problem QUERY Was Built to Fix

Every developer who has ever built a search endpoint has hit the same wall: how do you send a complex, structured request when the operation is read-only?

Historically, you had two flawed choices:

• GET is safe, idempotent, and cache-friendly — but it can't carry a request body. Complex filters get crammed into query strings, running into URL length limits (often around 8,000 characters, less if a proxy disagrees) and exposing sensitive parameters in logs.

• POST carries any body you want — but HTTP assumes POST changes state. That means no automatic caching, no safe retries, and a request that misrepresents its own intent.

For years, the industry defaulted to POST for read operations — GraphQL APIs, search endpoints, filter-heavy dashboards, and increasingly, AI-powered retrieval and RAG queries — even though nothing was actually being modified.

Meet QUERY: GET's Safety, POST's Flexibility

RFC 10008 defines QUERY as a method that combines the request-body flexibility of POST with the safe, idempotent semantics of GET. A basic request looks like this:

QUERY /users HTTP/1.1
Host: example.org
Content-Type: application/json

{ "role": "admin", "sort": "name", "page": 1 }

Because QUERY is explicitly marked safe and idempotent, intermediaries — proxies, CDNs, gateways — can treat it the same way they treat GET: cacheable, retry-safe, and self-descriptive about what the request actually does.

Why API Developers Are Excited

• Cleaner architecture for complex searches. E-commerce filters, analytics dashboards, and report builders can move structured criteria out of the URL and into a proper request body.

• Safe automatic retries. If a QUERY request times out, a client or proxy can resend it without risk of duplicating a state change — something POST never allowed.

• Built-in caching support. Responses to QUERY requests are cacheable, similar to GET, so identical queries can be served from cache instead of hitting your backend again.

• Content negotiation for query formats. An Accept-Query header lets a server advertise which query languages it supports — for example, application/sql or application/jsonpath — so clients aren't guessing.

What Security and Infrastructure Teams Should Check Before Adopting QUERY

QUERY is sound by design, but the surrounding infrastructure hasn't caught up yet. Before rolling it into production, review:

• WAF and gateway allowlists. Method whitelists written before mid-2026 likely don't include QUERY. Some stacks may reject it outright; others may route it inconsistently compared to POST.

• CORS behavior. QUERY is not on the CORS-safelisted method list, so cross-origin browser requests will trigger a preflight OPTIONS call.

• Cache key configuration. Since QUERY responses are cacheable and the cache key must account for the full request body, misconfigured caches risk cache poisoning or cache deception.

• Rate-limiting policy. If your gateway rate-limits by method (GET vs. POST, for example), decide explicitly whether QUERY inherits GET's policy or needs its own.

Framework and Browser Support: Where Things Stand

As of mid-2026, QUERY isn't yet baked into core HTTP/1.1 or HTTP/2 specifications at the framework level. Expect a rollout more than an overnight switch:

• Some backend frameworks have support in progress or under discussion.

• Express-based servers can already handle custom methods with manual configuration.

• CDN-level support may arrive first — RFC 10008 was co-authored by engineers from Cloudflare and Akamai, suggesting infrastructure providers are moving early.

The practical takeaway: understand the concept now, experiment in non-production environments if you control both client and server, and watch your framework's release notes through 2026 and 2027 before betting production traffic on it.

Where QUERY Fits in API Design Going Forward

QUERY is especially relevant for use cases where GET falls short and POST feels wrong: GraphQL-style query endpoints, AI-powered search and RAG retrieval, analytics and reporting APIs, and any endpoint with filter payloads too large or structured for a URL. For teams designing new API surfaces in 2026, it's worth factoring into your architecture decisions now, even if full adoption is still a year or two out.

Key Takeaways

• RFC 10008 (June 2026) standardizes QUERY — the first new HTTP method since PATCH in 2010.

• QUERY combines GET's safe, idempotent, cacheable semantics with POST's ability to carry a request body.

• It's designed for read-only operations with complex, structured payloads — search, filtering, GraphQL, and AI retrieval APIs are the clearest use cases.

• Infrastructure (WAFs, CORS, caches, rate limiters) needs explicit review before production adoption.

• Full framework and browser support will roll out gradually through 2026–2027.