If you've been building APIs for more than a few years, you've probably made your peace with a quiet little annoyance in REST design: what do you do when you need to search for something, but the search itself is too big, too sensitive, or too complicated to squeeze into a URL?
Most of us solved it the same tired way — jam a bunch of query parameters into the URL and hope nobody needs more than a handful of filters, or give up and abuse POST for something that isn't really "creating" anything at all. It's one of those compromises that's been sitting in the corner of API design for over a decade, and honestly, most of us just stopped noticing it.
Turns out, the people who write the actual HTTP specification noticed. And in June 2026, after years of draft proposals bouncing around the IETF, a brand-new HTTP method was officially standardized: QUERY.
This is the first new standard HTTP method to show up since PATCH was introduced back in 2010. Sixteen years is a long wait for a new verb, so it's worth understanding exactly what problem it solves and why it might quietly change how we design data-heavy APIs.
The Itch We've Been Scratching Wrong
Let's set the scene. Say you're building an endpoint that returns customer orders, and you want to let API consumers filter, sort, and select specific fields. The “correct” REST way to fetch a resource is GET, so naturally, that's where most of us start:
GET /orders?select=surname,givenname,email&limit=10&match="email=*@example.*"
It works fine — right up until it doesn't. A few things start to bite you:
• URLs aren't infinite. Most servers, proxies, and browsers cap URLs somewhere around 8,000 characters. Try expressing a real filter with ten conditions, a few joins, and some sorting logic, and you'll hit that wall faster than you'd expect.
• Everything in the URL gets logged. Access logs, browser history, proxy logs, analytics tools — they all capture full URLs. If your query includes anything remotely sensitive, that's now sitting in plaintext somewhere it probably shouldn't be.
• Complex queries just don't fit. Try encoding a JSONPath expression or a small SQL-like filter into query string syntax and you'll end up with something that looks like it survived a car crash.
So developers do what developers do — they route around the problem. And the usual detour is POST.
Why POST Isn't a Real Fix
Using POST to run a search feels reasonable at first. You get a request body, no size limit worth worrying about, and nothing sensitive leaking into a URL. Problem solved, right?
Not quite. POST was built to create or change something on the server, and that assumption follows it everywhere:
• It isn't idempotent. Fire the same POST twice and, depending on the backend, you might trigger it twice — which is exactly the kind of thing you don't want happening if your mobile app retries a dropped request.
• Caching basically doesn't exist for it. Browsers, CDNs, and proxies are built around the assumption that a POST might change something, so they won't cache the response by default.
• Intermediaries can't reason about it. A load balancer or gateway has no safe way to know if replaying a POST is harmless or dangerous, so most of them just... don't retry it.
That's how we ended up with awkward workarounds like calling POST to run the query, storing the result somewhere, and then following up with a GET to fetch it — three round trips just to run one search safely. It works, but nobody would call it elegant.
Enter QUERY
The QUERY method was designed specifically to close this gap, and it borrows the best traits of both GET and POST while leaving their baggage behind.
Here's what a request looks like:
QUERY /orders HTTP/1.1
Host: api.example.org
Content-Type: application/x-www-form-urlencoded
Accept: application/json
Notice the shape of it: the target resource is still identified in the request line, just like GET, but the actual query lives in the body, just like POST. That combination alone solves the size and encoding problems.
But the real trick is what happens underneath. QUERY is defined as a safe and idempotent method — meaning it's guaranteed never to change anything on the server, and running it once produces the same effect as running it ten times. That single property unlocks almost everything else:
• No practical size limit on what you can send, since it travels in the body.
• Safe to retry. If a mobile client loses signal mid-request, it can simply resend the exact same QUERY without any fear of duplicating data or corrupting state.
• Cacheable, like GET. Since nothing changes on the server, proxies and CDNs are free to cache the response, something that was never realistically possible with POST-based search endpoints.
• Optionally shareable. A server can respond with a Location header pointing to a saved version of that exact query. Anyone who later hits that URL re-runs the same search against fresh data — which is a neat way to support things like saved searches, shareable filters, or scheduled reports without building any of that logic yourself.
That last point deserves a second look, because it flips the usual pattern on its head. With a typical POST, the URL you get back points to the result of what you did. With QUERY, the URL can point to the request itself, so replaying it later gives you an updated answer rather than a frozen snapshot.
A Quick Example to Make It Concrete
Picture a support dashboard where an agent wants to pull up “every customer complaint filed in the last 30 days involving billing, sorted by severity, with only the fields relevant to a quick triage view.”
That's a real query, not a toggle you can express with two or three URL parameters. Today, most teams would build a custom POST /search/complaints endpoint, quietly break REST conventions, and hope nobody tries to cache or retry it. With QUERY, the same request becomes something the HTTP stack itself understands and can optimize:
QUERY /complaints HTTP/1.1
Host: support.example.org
Content-Type: application/json
Accept: application/json
{
"filter": { "category": "billing", "filed_within_days": 30 },
"sort": [{ "field": "severity", "order": "desc" }],
"select": ["id", "customer", "severity", "summary"]
}
If the agent bookmarks this search or shares it with a teammate, the server can hand back a Location pointing to /saved-queries/reports/billing-30d. Anyone who revisits that link later automatically gets the current state of billing complaints — no need to rebuild the query, and no risk of accidentally re-submitting it as a duplicate action the way a bookmarked POST never could.
How It Stacks Up
Seen this way, QUERY isn't really a competitor to GET or POST — it's the piece that was missing between them.
API Design Going Forward
One underrated side effect of QUERY is what it does to endpoint sprawl. It's fairly common to see APIs grow endpoints like this over time:
GET /api/users/active
GET /api/users/inactive
GET /api/users/premium
GET /api/users/inactive-premium
Each one exists because someone needed a slightly different filter and GET couldn't express it flexibly enough. With QUERY, that entire family collapses into a single endpoint — QUERY /api/users — where the filtering logic lives in the body instead of being baked into the URL structure. Fewer endpoints generally means less surface area to secure, document, version, and monitor.
A Dose of Reality
Before anyone rushes to swap out their search endpoints, it's worth being upfront: this is brand new. The specification (RFC 10008) was only finalized in June 2026, and actual support across servers, frameworks, browsers, and proxies is still catching up. Realistically, widespread adoption is more of a 2027–2028 story than something to ship into production tomorrow.
That said, this is exactly the right time to understand it. New standards tend to reshape how frameworks get designed years before they're mainstream, and knowing the “why” behind QUERY puts you ahead of the curve when tooling support does arrive.
Wrapping Up
QUERY isn't a flashy addition to HTTP, but it quietly fixes a problem nearly every backend developer has run into and worked around in their own slightly hacky way. It gives us a method that behaves like GET in terms of safety and caching, while behaving like POST in terms of carrying a real payload — without inheriting the downsides of either.
It's a small addition to the protocol, but for anyone building data-heavy or search-heavy APIs, it closes a gap that's been open for sixteen years. Worth keeping on your radar as you plan what your API layer looks like a couple of years from now.
Join the conversation! Your thoughts help the community grow.