Summary: The IETF published HTTP QUERY as RFC 10008 in mid-June 2026. QUERY is safe and idempotent like GET but can carry a request body, allowing complex read-only queries without URL length limits or POST’s non-idempotent semantics. Support remains limited, so the article recommends auditing every gateway, proxy, and server before adoption.
The HTTP QUERY method became RFC 10008 when the IETF published it in mid-June 2026. A few days later, the developer behind the Kreya tool wrote a long post on the problem this new method solves; on June 23 it was on the Hacker News front page, drawing hundreds of comments. For one HTTP method to get this much attention, the reason is no mystery: it presses on a sore spot familiar to anyone who has designed an API.
Put in one sentence, QUERY is as safe and idempotent as GET while gaining the option of a request body.
Years as a Draft, Then an RFC
Julian Reschke, James M. Snell of Cloudflare, and Mike Bishop of Akamai wrote RFC 10008, which descends from the HTTPBIS working group draft draft-ietf-httpbis-safe-method-wbody. That draft has been around: Hacker News users reposted and argued about it from 2022 on, and version 14 made it back to the front page in November 2025. Only now has it settled as a Proposed Standard. A process this long shows the field never agreed on whether a safe method should take a body; an RFC had to settle it.
Where GET Runs Out and POST Costs Too Much
The trouble starts with the URL: a complex read-only query crammed into GET runs into length limits, special characters demand encoding, sensitive parameters end up in server logs alongside the URL, and arrays or nested structures follow conventions each API invents for itself. POST is technically an option, but its semantics are wrong for reads — it is not idempotent, so automatic retries can repeat side effects, and middleware cannot treat such requests as read-only or cacheable. Sending a body with GET, meanwhile, is discouraged though not forbidden, and implementations disagree: some refuse the request outright, some drop the body without a word, some just process it.
QUERY’s move is to add a method, not redefine GET. The request content and its media type define the query — the spec offers form-urlencoded, SQL, JSONPath, and XSLT as examples — and the document also covers content negotiation, the 400/415/422/406 error codes, handing the result address back over Content-Location and Location, redirection, conditional requests, and range requests.
Caching and the New Accept-Query Header
Two design choices stand out. QUERY responses are cacheable, but the RFC warns that implementations “must be careful to incorporate the request content into the cache key”; skip that and unrelated queries share one cached entry. It is the easiest mistake in a do-it-yourself implementation, and it makes QUERY caching trickier than GET’s. Alongside it comes the new Accept-Query response header, a Structured Field letting servers declare which query media types they take, so clients can stop guessing.
Adoption, though, deserves caution. The author is frank that support remains limited — some clients, proxies, and web servers may refuse QUERY outright — and widespread availability is years away. Anyone operating gateways, caches, or service meshes should audit the path first, since every intermediary decides whether an unknown method passes. Kreya has shipped native support since version 1.20.
Adopting It: Advice for API Designers
The explainer’s guidance is down to earth: keep simple queries on GET, change nothing without a reason; when users need links they can share or bookmark, GET still wins; bring QUERY in only for complex read-only queries, and test every hop on the request path first.
For agent and API tooling builders there is an extra benefit: a structured query placed in the body escapes URL encoding and length caps, so program- or model-generated queries no longer have to be crammed into a query string. The HTTP method list has stood still for years — QUERY is one of the few true additions — and while nobody knows how fast proxies, frameworks, and clients will accept it everywhere, the direction is set.