Why the Web is Getting a New Verb: Understanding the HTTP QUERY Method

For over a decade, web architects have been forced into an uncomfortable compromise. When a request requires a complex set of parameters—structured data too large for a URI or sensitive filters that should not be exposed in server logs—we have had to choose between the URI length constraints of a GET request and the semantic overload of a POST. The latter is a particularly painful “hack”; by using POST for data retrieval, we forfeit the inherent benefits of the HTTP protocol, specifically idempotency and cacheability.

The publication of RFC 10008 in June 2026 marks the end of this architectural era. As a new Proposed Standard, the QUERY method introduces a dedicated, safe way to send a request body, finally evolving the way the internet communicates.

A Brand New Tool in the HTTP Toolbox

The formalization of the “QUERY” method is a rare event in the history of web standards. While the industry is accustomed to high-level framework updates, changes to the core list of HTTP verbs—the very grammar of the web—occur only once in a generation.

By reaching the status of a Proposed Standard, “The HTTP QUERY Method” moves from a theoretical proposal to a sanctioned part of the protocol. For senior architects, this isn’t just another feature; it is a foundational shift. It provides a formal path for complex data retrieval that avoids the middlebox interference and logging risks associated with bloated query strings, while maintaining the “safe” semantics that GET traditionally provided.

The “Safe Method with a Body” Holy Grail

The technical weight of this change is best understood by looking at the document’s long-standing working title: draft-ietf-httpbis-safe-method-w-body.

In the classical REST model, there is a binary divide: “safe” methods like GET are idempotent and fetch data without changing server state, but they lack a request body. Conversely, methods that support a body, like POST, are “unsafe” because they are designed to trigger state changes or processing.

Why does “safety” matter for a request with a body? The answer lies in cacheability and pre-fetching. Because the QUERY method is defined as safe and idempotent, intermediate proxies, CDNs, and browsers can technically cache the results of a request (subject to appropriate headers). Implementing caching for a POST request has always been a “hacky” nightmare involving custom headers and fragile configurations. QUERY brings this functionality into the light, allowing infrastructure to handle complex, body-heavy requests with the same efficiency it brings to simple GETs.

A Decade in the Making: A Consensus-Building Masterclass

RFC 10008 was not an overnight development; it was an 11-year marathon of meticulous architectural refinement. The timeline, as documented by the IETF, reflects the persistence required to change the fundamental architecture of the web:

• April 2015: James Snell introduces the initial concept as draft-snell-search-method.
• September 2018: A critical transition period as the community debated the scope of the new verb beyond simple search.
• September 2020: The httpbis Working Group officially adopts the project as draft-ietf-httpbis-safe-method-w-body.
• September 2024: A major revision point where the protocol’s mechanics were finalized before moving toward the home stretch.
• June 2026: The process culminates in the publication of RFC 10008.

This evolution was spearheaded by a “who’s who” of web standards: Julian Reschke, James Snell, and Mark Bishop. Their work represents a masterclass in building consensus across a decade of shifting industry needs.

The Evolution from “Search” to “Query”

The shift in nomenclature from “SEARCH” to “QUERY” was a strategic masterstroke by the httpbis working group. While a “SEARCH” verb might have felt limited to search-engine-style interfaces, “QUERY” suggests a much broader application.

The Working Group recognized that the need was universal, as evidenced by the document’s origins:

“Was draft-ietf-httpbis-safe-method-w-body (httpbis WG)”

This broader naming allows the verb to fit seamlessly into modern patterns like GraphQL operations, complex SQL-over-HTTP interfaces, and massive analytical filtering. It provides a clean semantic home for any operation where the “query” is too complex for a URL but the intent remains strictly a retrieval of information.

Conclusion: The Future of Web Interoperability

RFC 10008 fills the single largest gap remaining in the HTTP protocol. By providing a standardized, safe method that supports a request body, it eliminates the need for the architectural “smells” we have lived with for decades.

However, a standard is only as good as its implementation. We now face a “deployment gap”—the period during which CDNs, Load Balancers, and Web Application Firewalls (WAFs) must be updated to recognize and properly handle the new verb without flagging it as a malformed request. As these infrastructure pieces catch up, the way we design and consume APIs will fundamentally shift.

Now that we finally have a safe way to send a request body, how many of our “hacky” POST-based workarounds are about to become obsolete?