The IETF published RFC 10008 on 17 June 2026, formally standardizing the HTTP QUERY method — a request type that allows a request body while maintaining the same safety and reliability guarantees as GET.

This fills a long-standing gap in HTTP's design. Today's safe methods — GET, HEAD, OPTIONS — don't support request bodies, which forces API designers into an awkward trade-off: either cram complex queries into a URL (where size and character limits apply), or use POST, which technically implies the request changes something on the server. For queries that are read-only, POST is semantically misleading. QUERY resolves this by combining body support with the guarantees developers have relied on for GET: it won't cause side effects, it can be retried safely, and caches can store the response.

The specification emerged from the IETF's HTTPbis working group under the draft name draft-ietf-httpbis-safe-method-w-body and was co-authored by J. Reschke and J.M.. It reached Proposed Standard status — the first level in the IETF's standards progression — which signals it's ready for implementation and real-world testing, even if future versions may refine details. Proposed Standard RFCs carry enough authority that projects build interoperable systems around them; HTTP/1.1 itself spent years at this level before advancing further.

Why this matters in practice: caches and intermediaries — proxies, CDN edge nodes, API gateways — can now treat QUERY responses the same way they handle GET responses. A client can safely retry a failed QUERY without risk of accidentally changing data. Search APIs, analytics endpoints, and spatial query systems, which have historically been squeezed into POST because they're read-only but carry complex request data, now have a method whose semantics match what they actually do.

Adoption won't be immediate. HTTP client libraries, frameworks, server runtimes, and infrastructure software all need to add explicit support for QUERY. Unknown HTTP methods typically trigger a 405 error or are dropped silently, so early adopters will need fallback strategies. The transition period will require careful planning — much like what happened when PATCH rolled out under RFC 5789 in 2010, though the ecosystem's maturity today (with more open-source HTTP stacks and active maintainer communities) suggests the adoption curve should move faster.

The deeper value of RFC 10008 is less about inventing something new and more about formalizing what developers have already needed for years. The RFC gives QUERY a shared definition and a clear contract: it's safe, it's idempotent, it can carry a body. Infrastructure authors now have a stable target. API designers have a method that says exactly what it does. That kind of shared understanding — unsexy as it sounds — is what lets distributed systems reliably work together at scale.