RFC 10008 · Standards Track · June 2026
The HTTP QUERY Method
A new HTTP request method that's safe and idempotent like GET, but carries a request body like POST.
rfc-editor.org/rfc/rfc10008
QUERY lets you send a search request with a body, just like POST, but the server guarantees it's safe (no side effects) and idempotent (repeatable), just like GET. That means it can be cached, retried automatically, and trusted not to change anything on the server.
Why not just use GET or POST?
GET's limit
Query data has to fit in the URL. URLs have practical size limits, get logged by servers, and get saved in bookmarks. Complex queries just don't fit cleanly in a query string.
POST's limit
A body works fine, but POST isn't safe or idempotent by definition. Clients and intermediaries can't assume it's okay to cache the response or retry it automatically.
Method comparison
Property GET QUERY POST
Safe (no side effects)
Idempotent (safe to retry)
Has a request body
URI for the query itself by definition optional no
Cacheable for future GET/HEAD only
Example
request 
QUERY /contacts HTTP/1.1
Host: example.org
Content-Type: application/x-www-form-urlencoded
Accept: application/json

select=surname,givenname,email&limit=10&match="email=*@example.*"
response, 200 OK
[
  { "surname": "Smith", "givenname": "John", "email": "smith@example.org" },
  { "surname": "Jones", "givenname": "Sally", "email": "sally.jones@example.com" }
]
It looks just like a POST, but because it's QUERY, this request can be retried on failure and cached like a GET.
Key mechanisms
Accept-Query header
A resource advertises which query formats it supports (SQL, JSONPath, XSLT, etc.) so clients can discover them via OPTIONS or HEAD.
Location & Content-Location
A response can hand back a URI for the result (Content-Location) or for repeating the same query later via plain GET (Location).
Conditional requests & caching
Because QUERY is safe and idempotent, responses can be cached and revalidated with If-Modified-Since / ETags just like GET.
CORS preflight required
QUERY isn't a CORS-safelisted method, so browser cross-origin calls trigger a preflight OPTIONS request first.
Status codes to know
Code Meaning
200 Query processed, results in body
303 See results via GET at Location
304 Not Modified (conditional match)
400 Missing or inconsistent Content-Type
415 Query format not supported
422 Well-formed, but the query can't run
Credits
J. Reschke · J.M. Snell · M. Bishop, IETF HTTP Working Group
Read the full RFC