The biggest hack in REST history: using POST to read data. It's been happening since day one, and HTTP just fixed it.
Meet QUERY, the new official HTTP method (RFC 10008, June 2026). The first newly standardized method in 16 years.
The problem it solves:
GET is safe, idempotent, and cacheable, perfect for reading. But it takes no body, so everything goes in the URL. The moment your search filters get complex (nested JSON, pagination, combined criteria), the query string breaks down.
So we all reach for POST /search. It works, but you lose everything that makes GET great. POST isn't safe, idempotent, or cacheable. That's a workaround, not a fix.
QUERY takes the best of both: a body like POST, semantics like GET. Safe, idempotent, cacheable, with a body.
Support is getting there. Node.js has parsed it natively since 2024, and OpenAPI 3.2 can document it. Browser fetch support isn't here yet, but it's coming.
Next time you write POST /search, remember: it's a hack as old as REST itself, and it finally has a clean alternative.
RFC 10008. Worth keeping in your back pocket.
(Post image generated using Google Gemini)
