QUERY: The HTTP Method built for requests that read but need a body
Search endpoints have a dirty secret: they're rarely GET requests, even when they should be. The moment your filters get complex — nested conditions, arrays, a big list of IDs — you either run out of room in the URL, or you fight with query-string encoding until it's unreadable. So teams cheat. They make it a POST instead, even though nothing is being created or changed. It works, but it lies about what the request actually does: it's not safe, it's not idempotent, and every proxy, cache, and API gateway downstream now treats a read as a write.
That's the gap QUERY was designed to close — a method that behaves like GET (safe, idempotent, cacheable) but is allowed to carry a request body like POST. APIOrbit 26.3.2 now supports it as a first-class method, not a workaround.
What QUERY actually is
QUERY isn't an APIOrbit invention — it's a brand-new HTTP method, standardized as RFC 10008 in June 2026. It's the first new HTTP method in sixteen years (the last was PATCH, back in 2010), and it targets exactly the problem above: giving safe, read-only requests a place to put structured input that doesn't fit in a URL. Semantically it sits between GET and POST — safe and idempotent, no side effects implied, but with a real request body attached. Importantly, the spec defines a transport — the method and how it's carried — not a query language: what the body means is entirely up to your endpoint. As more frameworks and gateways adopt it, being able to build, inspect, and test QUERY properly starts to matter.
Picking QUERY like any other method
QUERY now shows up in APIOrbit's method picker with its own color, right alongside GET, POST, PUT, DELETE, and the rest — no separate mode, no hidden toggle.
A body, because that's the whole point
Since QUERY exists to carry a payload, APIOrbit gives it a full Body tab — the same one you already use for POST, PUT, and PATCH — plus headers, params, auth, and tests. Nothing about building a QUERY request feels bolted on.
It travels with your specs and your terminal
If your API already documents a QUERY operation, APIOrbit's OpenAPI and Swagger import recognizes it like any other verb — no manual re-tagging of imported requests. That matters more as tooling catches up: Node.js has parsed QUERY natively since early 2024, and OpenAPI 3.2 can document it as a first-class verb — so specs defining a QUERY operation are already a real thing you'll import. And when you need to hand a request to a teammate or drop it into a script, cURL export carries the body across correctly, the same way it does for POST and PUT.
Try it
If you've got an endpoint that reads but needs more than a URL can hold, give QUERY a spin — it's there in the method list waiting for you. As always, if something feels off or you want to see the standard land somewhere else in the app, a review or a message goes a long way in telling us what to build next.