IETF

QUERY solves two old annoyances at once: URL query strings have undefined length limits, and POST /search lies about idempotency. The new method is explicitly safe, idempotent, and cacheable, with the request body folded into the cache key.

But an engineer pointed out QUERY has existed in spirit since WebDAV's SEARCH method nearly two decades ago — and what killed it was proxies and WAFs stripping the body off methods they don't recognize. Until gateways catch up, POST stays the pragmatic choice.