HTTP got a new verb and I am unreasonably excited about it

Last month, while I was busy doing whatever it is I do, the IETF quietly published RFC 10008 and gave HTTP a brand new method called QUERY.

Let me put that in perspective. The last time HTTP got a new method, PATCH, it was 2010. I had not written a line of code. I did not know what an HTTP method was. I am fairly sure I thought “the cloud” was weather. The protocol that carries essentially everything has been running on the same set of verbs for sixteen years, and then one Friday in June it just… got a new one. And I get to be a working engineer while it happens. This feels like being alive when they added a new letter to the alphabet.

The lie we have all been telling

To explain why I am this excited about a document with section numbers, I need to explain the problem, which is a problem you have definitely had even if nobody ever said it out loud.

Say you want to search for something. A read. You are not creating anything, you are not changing anything, you are asking the server a question. Everything you know says this should be a GET. GETs are safe, they can be retried, they can be cached, they are the polite, well-behaved citizens of HTTP.

Except your search has fourteen filters, a date range, a sort order, and a list of IDs the frontend team keeps making longer. So you start cramming it all into the query string, and now your URL looks like a cat walked across a keyboard and then got encoded. Somewhere around the two thousandth character, something in the chain, a proxy, a server, a load balancer having a bad day, decides your URL is too long and drops it. Also the whole query is now sitting in access logs, which is a fun surprise when one of the filters is an email address.

“Fine,” you say, “I will put the query in the request body.” And here HTTP looks at you like you asked to microwave fish in the office kitchen. A GET body is not technically forbidden, it is worse, it is undefined. Some servers ignore it. Some tools refuse to send it. It is the protocol equivalent of a shrug.

So we all do the same thing. We make it a POST. POST /api/search. And every time, a tiny lie gets told, because POST means “this is unsafe, do not retry it, do not cache it, this might change things”, and our request changes nothing. We took the most honest request in the system, a simple question, and dressed it up as the most dangerous kind. Caches will not touch it. Clients will not auto-retry it. The semantics are just gone, and we all agreed not to talk about it.

Enter QUERY, the GET with a body we were promised

QUERY is exactly what it sounds like. It is a request that says: here is a body containing my question, process it, and I solemnly swear this is read-only.

Safe. It does not change anything on the server. It is a question, not an instruction.
Idempotent. Send it once, send it five times because your WiFi hiccuped, same result. Clients and libraries are allowed to retry it automatically, which they will never do for a POST.
Cacheable. Like a GET, responses can be cached. This is the big one for me.
Has a body. On purpose. From day one. No shrug.

So the search endpoint becomes:

QUERY /contacts HTTP/1.1
Host: example.org
Content-Type: application/json

{ "role": "engineer", "location": "Centurion", "limit": 20 }

No thousand-character URL. No sensitive data smeared across the query string. No pretending a read is a write. Just a question, in a body, with the semantics to match.

The details that made me actually gasp

The headline feature is nice, but the RFC has a few touches that made me put my phone down and stare at the wall for a bit.

The cache key includes the body. For GET, caches key on the URL. For QUERY, the spec says the cache key must incorporate the request content, and caches are even allowed to normalise it first, so {"a":1,"b":2} and the same JSON with different whitespace can hit the same cache entry. Someone thought about JSON key order while writing a standards document. I respect that so much.

The server can hand you a shortcut. A QUERY response can include a Location header pointing at a URL that represents your results. So you send your big query body once, and the server replies “here you go, and by the way, next time just GET this URL”. Your expensive search quietly becomes a cheap, cacheable link. That is such a tidy idea I am a little annoyed I never thought to want it.

There is an Accept-Query header. Servers can advertise which query formats they accept, JSON, SQL-ish things, whatever, so a client can find out how to ask before asking. The protocol is politely telling you the rules of the conversation up front, which is more than most of my code does.

It is strict about Content-Type. If the body does not match the declared type, the server must fail the request. No mystery payloads. After years of APIs accepting whatever and guessing, a spec that says “no, actually, mean what you say” feels almost confrontational, in a good way.

The part where I calm down slightly

Now for the honesty section. QUERY became a Proposed Standard in June 2026, which in web infrastructure time means it was born about four seconds ago. Your framework may not route it yet. Your favourite HTTP client may look at QUERY and throw an exception with an apologetic tone. Proxies, gateways, WAFs, all the middleboxes that live between you and the user, each one needs to learn the new verb, and middleboxes learn slowly. .NET 10 already speaks it, others are on the way, and the rest of us get to watch support light up ecosystem by ecosystem like a very slow, very nerdy scoreboard.

So no, I am not rewriting anything on Monday. POST /search will keep the lights on a while longer, dishonest as it is.

But that is not really why I am excited. I am excited because the web is supposed to be this ancient, finished thing, all the interesting decisions made decades ago by people in mailing list archives, and then it just is not. Somebody looked at a workaround we had all accepted as a law of nature, sixteen years of it, and said, no, let us fix the actual protocol. And they did. And I was around to see it.

The alphabet got a new letter. I intend to use it the moment anything lets me.