The IETF published RFC 10008 on 17 June 2026, formally specifying the HTTP QUERY method — a safe, idempotent request method that, unlike GET, is permitted to carry a request body.

The gap RFC 10008 fills has been a long-standing friction point for API designers. HTTP's existing safe methods — GET, HEAD, OPTIONS — carry no body, which forces developers who need to express complex, structured query predicates into an uncomfortable choice: encode everything into a URL (with well-documented length and character-set constraints), or reach for POST, sacrificing the semantics of safety and idempotency. QUERY resolves that tension by combining the safety guarantee — meaning it has no observable side effects — with idempotency and the ability to include content in the request.

The specification, titled The HTTP QUERY Method and co-authored by J. Reschke and J.M., emerged from the IETF HTTPbis working group, where it was progressed through the standards track under the draft name draft-ietf-httpbis-safe-method-w-body before reaching Proposed Standard status.

Proposed Standard is the first rung on the IETF's full standards ladder. It signals that the specification is stable enough for implementation and deployment, even if it may be refined through operational experience. For most practical purposes in the industry, Proposed Standard RFCs carry sufficient weight to anchor interoperable implementations — HTTP/1.1 itself spent years at Proposed Standard before advancing.

The practical consequences are worth spelling out. Caches can treat QUERY responses as cacheable in the same way they treat GET responses, because the safety and idempotency properties are now formally defined at the protocol level. A client can retry a failed QUERY without risk of unintended state mutation, matching the retry semantics already applied to GET. Intermediaries — proxies, CDN edge nodes, API gateways — now have a standards basis for handling a body-bearing safe method rather than improvising against implementation-specific conventions.

This matters most where query complexity outgrows what a URL can reasonably hold. GraphQL over HTTP has long accepted POST as the dominant transport for this reason, even though many GraphQL queries are read-only and semantically safe. Search APIs, analytics endpoints, and spatial query interfaces — think GeoJSON predicate filtering across large datasets — have similarly been forced into POST. QUERY gives those use cases a method whose semantics accurately reflect their intent.

The HTTP ecosystem tends to move deliberately, and adoption of a new method will not be instantaneous. Frameworks, HTTP client libraries, server runtimes, and intermediary software all need to add explicit handling. A new method that flows through infrastructure which treats it as unknown will typically trigger a 405 or be silently dropped, which means the transition period will require careful negotiation of capability. Developers building on QUERY early should plan for fallback strategies until library support consolidates.

That said, the path from RFC publication to broad support is better understood now than it was in earlier cycles of HTTP evolution. The proliferation of open-source HTTP stacks with active maintainer communities, and the relatively clear precedent set by methods like PATCH — which followed a similar trajectory from RFC 5789 in 2010 to routine framework support — suggests the runway to practical adoption is shorter than it once would have been.

The deeper value of RFC 10008 is arguably normative rather than novel. The underlying need it addresses has been implemented, worked around, and debated for years. What the RFC provides is a shared, unambiguous name and a defined contract: QUERY is safe, QUERY is idempotent, QUERY may contain a body. Infrastructure authors now have a stable target. API designers now have a method that says what it means. That kind of terminological clarity — boring as it sounds — is what makes distributed systems interoperate reliably at scale.