For more than 16 years, the HTTP ecosystem remained remarkably stable.
After PATCH became an official HTTP method in 2010, developers simply accepted one awkward reality: there was no proper HTTP method for sending complex, read-only queries.
When search filters became too large for a URL, developers quietly switched to POST—even though POST was never designed for read-only operations.
That long-standing compromise has finally ended.
In June 2026, the Internet Engineering Task Force (IETF) officially published RFC 10008, introducing HTTP QUERY—the first standardized HTTP method since PATCH. It combines the flexibility of POST request bodies with the safety and semantics of GET.
Although ecosystem support is still in its early stages, QUERY represents one of the most meaningful improvements to REST API design in years.
Key Takeaway
HTTP QUERY solves a problem developers have worked around for over a decade: performing complex, read-only searches without abusing POST or overloading GET URLs.
Why GET Was Never Enough
For simple APIs, GET works beautifully.
GET /products?category=books&page=2The problems begin once applications grow.
Modern APIs frequently need:
Multiple filters
Nested conditions
Arrays
Sorting
Pagination
JSON-based search criteria
GraphQL-like filtering
SQL-inspired query languages
Eventually, URLs become monsters.
GET /orders?filter[and][0][price][lt]=30&filter[and][1][status]=active...These URLs aren't just ugly.
They introduce several real technical problems.
Practical limitations of GET
URL length limits – Browsers, proxies, and servers often impose URL length limits (commonly several KB, with many environments around 8 KB).
Difficult encoding – Special characters, arrays, and nested structures require complex URL encoding.
Poor readability – Large query strings become difficult to read, debug, and maintain manually.
Logging exposure – Query parameters are frequently recorded in server logs, analytics platforms, and monitoring tools.
No standard structure – Arrays and nested objects are represented differently across frameworks, leading to inconsistencies.
✅ GET remains the best choice for simple filtering and retrieval.
⚠️ For advanced or complex searches, its limitations become more apparent.
Why GET With a Request Body Never Worked
Many developers have asked the obvious question:
"Why not simply send JSON in a GET request?"
Unfortunately, HTTP never standardized semantics for GET request bodies.
Different clients behave differently:
Some ignore the body.
Some strip it.
Some reject the request entirely.
Some proxies never forward it.
Because of this inconsistent behavior across browsers, firewalls, proxies and servers, GET bodies are considered unreliable for production APIs.
Changing GET itself wasn't realistic because it would break decades of existing infrastructure.
Instead, the standards community chose a different path.
They created a brand-new HTTP method.
Why POST Was Always an Imperfect Workaround
Most APIs solved the problem by switching search endpoints to POST.
POST /products/search
{
"category": "books",
"price": {
"lt": 30
}
}
Technically, it works.
Semantically, it's wrong.
POST indicates that the client wants the server to perform processing that may change state.
A search request usually doesn't.
That distinction matters more than many developers realize.
What is idempotency?
An operation is idempotent when executing it multiple times produces the same effect as executing it once.
Examples:
✅ GET /users/42
Repeated requests always return the same resource.
✅ QUERY /products
Running the same search multiple times is safe.
❌ POST /users
Running it twice creates two users.
Why POST causes problems
Because POST is not idempotent:
Automatic retries become risky.
HTTP libraries hesitate to replay failed requests.
Proxies cannot safely retry them.
Caching becomes significantly more complicated.
The HTTP semantics no longer accurately describe the operation.
Developers have spent years inventing concepts like "safe POST" simply because HTTP lacked a better option.
Meet HTTP QUERY (RFC 10008)
QUERY is remarkably simple conceptually.
Think of it as:
GET + Request Body
The request body contains the search definition.
The HTTP semantics remain those of a safe, read-only operation.
Example:
QUERY /products/search
Content-Type: application/json
{
"category": "books",
"price": {
"lt": 30
},
"sort": [
"-published",
"title"
],
"page": {
"size": 20
}
}
The server simply returns matching results.
No state changes.
No semantic compromises.
GET vs POST vs QUERY
🟢 GET
✅ Safe
✅ Idempotent
❌ Supports request body
✅ Cacheable by default
✅ Safe automatic retries
⚠️ Best for simple searches only
🟠 POST
❌ Not safe
❌ Not idempotent
✅ Supports request body
⚠️ Cacheable only with explicit support
❌ Automatic retries are not safe
⚠️ Common workaround for complex searches
🔵 QUERY
✅ Safe
✅ Idempotent
✅ Supports request body
✅ Cacheable by default
✅ Safe automatic retries
✅ Designed specifically for complex searches
What Makes QUERY Different?
QUERY isn't simply "POST for searches."
It introduces several important semantic guarantees.
1. Safe
A QUERY request promises not to modify server state.
That allows infrastructure to treat it similarly to GET.
2. Idempotent
If a network connection drops halfway through a request, clients may safely retry it without worrying about duplicate side effects.
This is particularly valuable for:
Microservices
Cloud APIs
Distributed systems
Automatic resilience frameworks
3. Request Body Support
Unlike GET, QUERY officially defines semantics for request bodies.
Bodies may contain:
JSON
GraphQL
SQL
JSONPath
XML
Custom query languages
The media type is determined through Content-Type, which is mandatory.
4. Better Caching Potential
QUERY responses are cacheable under HTTP semantics.
However, caches must incorporate the request body into the cache key.
This is far more complex than traditional GET caching, which is one reason widespread implementation will take time.
Important HTTP Details Developers Should Know
RFC 10008 defines several implementation requirements that make QUERY predictable.
Required Content-Type
Every QUERY request should specify a media type describing the query language.
Missing or invalid Content-Type should result in an error.
Content-Location and Location
One interesting capability introduced by the RFC is the ability to associate queries or results with URLs.
Two related ideas often appear in discussions:
Content-Location can identify a resource representing the returned result.
Some implementations may expose a persistent URI representing the query itself, allowing the same search to be rerun later without resending the original request body.
This enables scenarios such as:
Bookmarking searches
Sharing queries
Periodically rerunning saved searches
Building richer caching strategies
Because implementations are still emerging, exactly how these URIs are exposed may vary.
Current Framework Support
Although RFC 10008 is now standardized, software support is still catching up.
Some frameworks have already moved surprisingly quickly.
.NET 10
Microsoft is among the earliest adopters.
Client support includes:
HttpMethod.QueryServer-side support includes:
HttpMethods.QueryHttpMethods.IsQuery()
Minimal APIs can register QUERY endpoints using:
MapMethods(...)Convenience helpers like MapQuery() and [HttpQuery] were proposed but intentionally omitted from .NET 10. Developers can easily create small extension methods to fill the gap.
Another notable detail is resilience.
Because .NET understands QUERY is idempotent, retry mechanisms integrate naturally with existing HTTP resilience libraries.
Testing Helpers
query()
queryJson()
These mirror the existing helper methods for POST, PUT and DELETE, making QUERY feel like a first-class citizen inside Laravel applications.
Laravel 13.19 also introduced unrelated improvements, including:
reduceInto()for collectionscounted()string helperBatch SQS dispatch improvements
Queue inspection enhancements
Browser Support Is Still the Biggest Obstacle
This is where reality catches up with the specification.
Although QUERY is standardized:
Browsers currently do not reliably support QUERY via Fetch or XHR.
Many proxies still treat unknown HTTP methods cautiously.
CDNs are only beginning to consider QUERY-aware caching.
OpenAPI 3.1 has not yet standardized QUERY, meaning some tooling excludes these endpoints from generated API specifications.
Framework support is arriving faster than browser support.
That means QUERY currently shines most in server-to-server communication, where both client and server are under your control.
When Should You Use QUERY?
The answer depends entirely on your audience.
Excellent use cases
✅ Internal microservices
✅ Enterprise APIs
✅ Cloud-native service communication
✅ Complex search endpoints
✅ Analytics APIs
✅ Report generation
Stick with GET when
Filters are simple.
URLs remain readable.
Users need bookmarkable links.
Browser compatibility is essential.
Keep POST when
Public browser clients cannot yet send QUERY.
Many organizations will likely expose both:
QUERY for internal services
POST as a compatibility fallback
This dual-endpoint strategy allows gradual adoption while remaining compatible with existing clients.
Who Created QUERY?
QUERY emerged from the IETF HTTP Working Group (HTTPbis) after years of discussion.
The RFC was authored by respected figures in HTTP infrastructure, including contributors from:
Cloudflare
Akamai
Their involvement is significant.
Companies operating global CDNs understand better than almost anyone how important standardized caching semantics are for modern APIs.
Final Thoughts
HTTP QUERY may look like a small addition to HTTP, but it solves one of REST's oldest design compromises.
For years, developers had to choose between:
GET with increasingly unmanageable URLs, or
POST with incorrect semantics.
QUERY finally removes that trade-off.
It provides the request body flexibility developers need while preserving the guarantees that make HTTP reliable: safety, idempotency, cacheability, and replayability.
The ecosystem still needs time to catch up. Browsers, proxies, CDNs, and API tooling will gradually adopt the standard over the coming years. But framework support has already begun, and service-to-service architectures can benefit today.
Like PATCH before it, QUERY won't transform the web overnight. Yet as APIs continue to grow more sophisticated, RFC 10008 may eventually become one of the most important HTTP standards introduced in the past decade.