Maintained by Epic Games, Lore is de­signed for un­prece­dented scal­a­bil­ity of both data and teams. It’s op­ti­mized for pro­jects—in­clud­ing games and en­ter­tain­ment—that com­bine code with large bi­nary as­sets, and caters for the needs of de­vel­op­ers and artists alike.

Key find­ings

74%

con­sumers say the in­ter­net feels less hu­man than 10 years ago

40 min

av­er­age time be­fore con­sumers ex­pe­ri­ence “bot fa­tigue”

61%

con­sumers can’t name a brand us­ing AI well in its mes­sag­ing

16.6

av­er­age weekly hours en­ter­prise teams spend im­prov­ing AI vis­i­bil­ity

Brands have been chas­ing AI vis­i­bil­ity for two years. You’ve spent time and bud­get on it, yet your au­di­ence can’t name a sin­gle com­pany they think is do­ing it well. The brands build­ing for the next phase treat their web­site as the place where AI gets clean data and hu­mans get some­thing worth their time.

A less hu­man web costs you read­ers.

Your au­di­ence can sense when a ma­chine is talk­ing to them. Most are check­ing out be­fore they’ve de­cided whether they care. Bot fa­tigue sets in when the in­ter­net stops feel­ing hon­est. The small mo­ments that used to make the web worth vis­it­ing are dis­ap­pear­ing.

The AI web

7/10

con­sumers say the in­ter­net feels less hu­man than it did 10 years ago

Feels less hu­man

Still hu­man

40 min

the av­er­age time to “bot fa­tigue,” when in­ter­ac­tions start to feel syn­thetic

Can your con­tent in­fra­struc­ture mea­sure this shift and re­spond to it? We’ll cover how en­ter­prise teams re­struc­ture con­tent for AI dis­cov­ery with­out los­ing what feels hu­man in our up­com­ing we­bi­nar.

What is AI brand vis­i­bil­ity?

AI brand vis­i­bil­ity is how of­ten a brand ap­pears in an­swers gen­er­ated by AI en­gines like ChatGPT, Perplexity, Claude, and Gemini. It’s a dif­fer­ent prob­lem from search en­gine vis­i­bil­ity, which mea­sures rank­ings on re­sult pages. A brand can rank at the top of Google and not ap­pear in­side ChatGPT at all. As of 2026, no sin­gle dash­board tracks AI brand vis­i­bil­ity across every en­gine, and the cat­e­gory has no es­tab­lished leader.

Nobody has won AI brand vis­i­bil­ity yet.

Every an­swer in our con­sumer sur­vey pointed the same way: Nobody has done it well yet. Brands have spent the past year fund­ing AI strat­egy, but con­sumers can’t point to a sin­gle com­pany they think is get­ting it right.

The cat­e­gory has no in­cum­bent, and no tem­plate to copy. The brand that builds that recog­ni­tion first gets to de­fine the stan­dard.

Brand vis­i­bil­ity

61%

of con­sumers can’t name a brand that uses AI well in its mes­sag­ing

16%

say no brand is us­ing AI well at all

60%

say AI in a brand’s mes­sag­ing is a turnoff, not a fea­ture

“No cus­tomer or user wakes up and says, ‘I hope I get to talk to a chat bot or an AI agent to­day.’ Human-centered de­sign is truer to­day with ar­ti­fi­cial in­tel­li­gence. Ironically, the an­swer is us­ing AI to be more hu­man.”— Brian Solis, Head of Global Innovation, ServiceNow

“No cus­tomer or user wakes up and says, ‘I hope I get to talk to a chat bot or an AI agent to­day.’ Human-centered de­sign is truer to­day with ar­ti­fi­cial in­tel­li­gence. Ironically, the an­swer is us­ing AI to be more hu­man.”

Build for both au­di­ences at once.

AI needs to find the con­tent and a per­son needs a rea­son to stay once they ar­rive. The sec­ond part is harder, and most en­ter­prises are still guess­ing at it. The brands worth watch­ing are bet­ting that “staying” comes from giv­ing peo­ple some­thing to do: in­ter­ac­tive con­tent, dy­namic ex­pe­ri­ences, the small mo­ments a flat AI sum­mary can’t de­liver.

The web­site is the only place where both jobs run to­gether. AI gets struc­tured con­tent it can cite, and the reader gets some­thing worth their time. That’s the foun­da­tion you get on WordPress VIP.

The guide for build­ing that dual-pur­pose site is in Future-Proof Your Brand for the AI-Native Web, a frame­work for prepar­ing your web plat­form.

How en­ter­prises are mea­sur­ing AI brand vis­i­bil­ity

The cat­e­gory is barely two years old and the toolset is still set­tling. No sin­gle dash­board tracks every AI sur­face. No shared de­f­i­n­i­tion of “good” ex­ists yet. Pricing across the cat­e­gory swings from free to six fig­ures de­pend­ing on cov­er­age and cus­tomiza­tion. What en­ter­prises are us­ing right now sorts into five cat­e­gories, with real tools in­side each.

This is a snap­shot since the spe­cific prod­ucts will shift in the next 12 months. The cat­e­gories will out­last them, which is why the sec­tion is or­ga­nized around what the tools do.

This is the newest cat­e­gory, built specif­i­cally to track how of­ten a brand ap­pears in ChatGPT, Perplexity, Claude, and Gemini an­swers. These tools sim­u­late queries at scale and sur­face ci­ta­tion fre­quency and sen­ti­ment over time.

Tools in this cat­e­gory: Profound, BrightEdge, brand­vis­i­bil­ity.ai, Tryevergreen, and a hand­ful of smaller com­peti­tors that emerged in late 2025.

Best for: Teams that need to con­nect AI vis­i­bil­ity to busi­ness out­comes. AI ci­ta­tions are top-of-fun­nel. This cat­e­gory mea­sures what those ci­ta­tions turn into. The brands that fig­ure out which AI-referred vis­i­tors con­vert can de­fend their AI strat­egy spend.

Watch for: Pricing mod­els are still set­tling. Most plat­forms re­quire four to six weeks of data col­lec­tion be­fore bench­marks are mean­ing­ful. Sample-based query sim­u­la­tion has gaps, and tools that promise “complete cov­er­age” of every AI an­swer are over­stat­ing their method­ol­ogy.

These are the es­tab­lished SEO plat­forms that ex­tended into AI track­ing start­ing in 2024. These tools layer AI ci­ta­tion data on top of tra­di­tional search met­rics, which makes them use­ful for teams al­ready run­ning SEO work­flows.

Tools in this cat­e­gory: Similarweb (AI Intelligence), Semrush (AI Toolkit), Ahrefs (Brand Radar).

Best for: SEO teams that want AI vis­i­bil­ity data with­out a new ven­dor re­la­tion­ship. The in­te­gra­tion with ex­ist­ing search re­port­ing is the main value; it lets a team see or­ganic and AI traf­fic in the same view.

Watch for: AI cov­er­age in this cat­e­gory is gen­er­ally nar­rower than in ded­i­cated AI ci­ta­tion plat­forms. The tools were built for search and are still catch­ing up on the AI side. AI num­bers here have to be treated as di­rec­tional.

In this cat­e­gory: the an­a­lyt­ics plat­forms that de­tect and seg­ment traf­fic ar­riv­ing from AI en­gines. These are the ci­ta­tion mon­i­tor­ing tools that tell a brand it’s be­ing men­tioned. This cat­e­gory tells a brand what hap­pens af­ter.

Tools in this cat­e­gory: Parse.ly (part of the WordPress VIP prod­uct fam­ily), Plausible, Fathom Analytics, and most en­ter­prise an­a­lyt­ics plat­forms (Google Analytics 4) with cus­tom seg­men­ta­tion.

Best for: Teams that need to con­nect AI vis­i­bil­ity to busi­ness out­comes. AI ci­ta­tions are top-of-fun­nel. This cat­e­gory mea­sures what those ci­ta­tions turn into. The brands that fig­ure out which AI-referred vis­i­tors con­vert can de­fend their AI strat­egy spend.

Watch for: AI re­fer­rer de­tec­tion still varies by plat­form. Some AI en­gines pass clean re­fer­rer head­ers, oth­ers rely on UTM tag­ging. Coordination be­tween con­tent and an­a­lyt­ics teams is usu­ally re­quired to get clean data.

Broader brand mon­i­tor­ing plat­forms that added AI sur­face track­ing to ex­ist­ing so­cial lis­ten­ing and PR mon­i­tor­ing ca­pa­bil­i­ties. These cover AI en­gines as one in­put along­side so­cial and tra­di­tional me­dia men­tions.

Tools in this cat­e­gory: Brandwatch, Talkwalker, Meltwater.

Best for: Communications and PR teams that al­ready use these plat­forms for cri­sis mon­i­tor­ing and share-of-voice track­ing. The AI cov­er­age is an ex­ten­sion of an ex­ist­ing work­flow.

Watch for: AI cov­er­age in this cat­e­gory tends to be lighter than in ded­i­cated AI ci­ta­tion tools. Useful for a 30,000-foot view, less use­ful for gran­u­lar ci­ta­tion analy­sis.

This is what en­ter­prises with en­gi­neer­ing ca­pac­ity are build­ing them­selves. These so­lu­tions use LLM APIs to query AI en­gines on a sched­ule and sur­face re­sults in a dash­board the team con­trols. Pew Research Center’s work with WordPress VIP, cov­ered in Chapter 2, is one ex­am­ple of this ap­proach.

Best for: Enterprises with en­gi­neer­ing re­sources who want to de­fine their own queries and con­trol their own data. Ideal when the brand’s AI vis­i­bil­ity strat­egy de­pends on niche or in­dus­try-spe­cific queries that off-the-shelf tools don’t cover well.

Watch for: Maintenance bur­den. LLM API ac­cess is now sta­ble, though pric­ing and rate lim­its change fre­quently. Custom dash­boards re­quire on­go­ing en­gi­neer­ing at­ten­tion to keep cur­rent.

AI brand vis­i­bil­ity tools at a glance

How to choose

Match the tool cat­e­gory to the ques­tion the team needs to an­swer:

“Are we be­ing cited?” Use an AI ci­ta­tion mon­i­tor­ing plat­form.

“Are we be­ing cited rel­a­tive to our search per­for­mance?” Use search an­a­lyt­ics with AI over­lays.

“What hap­pens af­ter we’re cited?” Use web an­a­lyt­ics with AI re­fer­ral track­ing.

“How does AI fit into our broader brand sen­ti­ment?” Use a brand in­tel­li­gence plat­form.

“We need to track some­thing none of the above can an­swer.” Build a cus­tom so­lu­tion.

Most en­ter­prises use two cat­e­gories to­gether. The most com­mon com­bi­na­tion is a tool from the AI ci­ta­tion mon­i­tor­ing cat­e­gory to know whether the brand shows up, and a tool from the web an­a­lyt­ics cat­e­gory to know what that vis­i­bil­ity is worth. The brands that fig­ured this out first are the ones whose 2027 AI vis­i­bil­ity bud­gets won’t be re-lit­i­gated in bud­get meet­ings.

Continue read­ing

Chapter 2

Brands chase AI vis­i­bil­ity. Consumers chase the source.

Chapter 3

Consumers are wary of gate­keep­ing. More than mar­keters are.

Chapter 4

The web­site is still the de­fault trust layer.

Chapter 5

The next web­site does­n’t look like a web­site.

FAQs about AI brand vis­i­bil­ity

Bot fa­tigue is the point at which on­line in­ter­ac­tions start to feel syn­thetic. WordPress VIP’s 2026 sur­vey of 1,200 U.S. con­sumers found the av­er­age per­son hits bot fa­tigue in about 40 min­utes. The broader pat­tern: 74% of con­sumers say the in­ter­net feels less hu­man than it did 10 years ago, which is the con­sumer-mood shift dri­ving most of what brands are now try­ing to solve in their AI strat­egy.

Not yet. The cat­e­gory is too new and the mea­sure­ment tools are too im­ma­ture. Platforms cite dif­fer­ent sources for dif­fer­ent queries, the ci­ta­tions change as mod­els up­date, and the met­rics en­ter­prise teams use to track AI vis­i­bil­ity aren’t stan­dard­ized across ven­dors. What’s clear is that no brand has built a durable AI pres­ence. The brand that de­fines what “AI brand vis­i­bil­ity done well” looks like will be the one that fig­ures out the mea­sure­ment layer be­fore the rest of the mar­ket does.

The web­site has two jobs now and they have to run on the same foun­da­tion. AI en­gines need struc­tured con­tent they can find and cite ac­cu­rately. Human vis­i­tors need a rea­son to stay once they click through from an AI sum­mary. The brands solv­ing for both are treat­ing the web­site as the place where AI ex­tracts data and a per­son has an ex­pe­ri­ence worth their time. This is the cen­tral ar­gu­ment of WordPress VIP’s 2026 State of the Open Web re­port.

GrapheneOS Discussion Forum

We’re in the era of tril­lion-dol­lar com­pa­nies, but that does­n’t mean you should leave $5 on the table!

Take, for ex­am­ple, Photobucket. In case you’ve never heard of it, it is the Imgur-equivalent of ages ago. I was us­ing it as a kid to up­load im­ages there and link them on var­i­ous fo­rums. A nice, sim­ple web­site that just did its job.

So what’s my old pal Photobucket do­ing now?

Well, re­cently, I was go­ing through my old ac­counts and started clean­ing them up. Deleting what needs to be deleted, restor­ing pass­words to what was no longer work­ing, things like that1…

And that’s how I re­mem­bered about Photobucket!

Now, mind you, that was af­ter I’d al­ready found my old Imgur ac­count with hun­dreds of old (and nos­tal­gic!) screen­shots that I then backed up safely. So I was re­ally ex­cited! This Photobucket ac­count must have been… damn… even older! Who knows what rem­nants of my child­hood I’ll find there?

And so, I logged in ex­pec­tantly. Ready to be amazed! Prepared to drop a nos­tal­gia tear! Excited to fi­nally…

Wait, WHAT?!!

You shared them. We pro­tected them.

…

AGAINST WHAT?!! Because it sure as hell is­n’t against cor­po­rate greed! More like:

You shared them. We pay­walled them. (And you should thank us!)

You shared them. We pay­walled them. (And you should thank us!)

So I now have to pay for the im­ages I up­loaded on a (previously) free ser­vice?!! No way, I’m not do­ing that! Take my im­ages and keep them on your servers un­til you go bank­rupt! I won’t en­dorse such be­hav­ior by giv­ing you money.

I’m no fool!

…

But… I mean it’s just $5… Surely my child­hood mem­o­ries must be worth more than that, right? And I guess it’s kinda nice they did­n’t delete them… So, okay, I’ll give this some thought and…

$5… PER MONTH?!!

So this unas­sum­ing claim:

It’s time to re­live them for just $5.

It’s time to re­live them for just $5.

from the sweet-sweet Photobucket Inc. was miss­ing just a tiny lit­tle de­tail… a foot­note… some legalese, as you might say… That it’s a MONTHLY SUBSCRIPTION, MAYBE?!!

THE. BLATANT. GREED!

So they’re hop­ing that I’m cu­ri­ous, I pay for this crap, and then for­get about my MONTHLY SUBSCRIPTION? Oh no, no, no. That’s al­most evil. Paywalling my child­hood mem­o­ries in or­der to trap me into ac­ci­den­tally sub­scrib­ing to your use­less ser­vice? Hoping I’d then can­cel it af­ter maybe a few years, when I fi­nally no­tice an odd ex­pense on my card?

NO.

Just no. I won’t stand for this. Childhood mem­o­ries be damned!

Aw man… I re­ally won­der what’s in there… I mean it’s just a sub­scrip­tion… I pay the $5, I down­load my im­ages, I can­cel the sub­scrip­tion, and I’m outta there. May God be my wit­ness that it was­n’t an easy call, that I fought for my dig­nity!

Ok, let’s do this quickly. I want to min­i­mize the pain.

Enter the card de­tails… click on Pay by Card… wait a bit…

And I’m in!

Finally! Really won­der­ing what’s in here! Let’s take a… look……

Oh… No…

IS IT FREAKING EMPTY?!!

…

I think I hate my­self now. I’m such a fool!!! That’s what I get for go­ing along with these preda­tory tac­tics… Should’ve known this would hap­pen. I guess I was us­ing a dif­fer­ent, even older Photobucket ac­count as a kid, or some­thing.

…

Wait.

Photobucket. You must have known I don’t have any im­ages on my ac­count. AND YOU STILL MADE ME PAY?!! Reclaim your mem­o­ries my ass.

That’s it, I’m done.

I knew I for­got some­thing!

Okay. Now I’m done.

Editor’s note

As I was writ­ing and re­liv­ing this beau­ti­ful ex­pe­ri­ence, I no­ticed a lit­tle foot­note on the pay­ments page:

Did I no­tice this in time to re­quest the re­fund? Of course I did­n’t. Those 5 beau­ti­ful dol­lars are for­ever gone.

But maybe this helps some­one… Yay to the move­ment against cor­po­rate greed!… 🍻

Update

This post ended up be­ing pretty pop­u­lar on Hacker News with lots of fun dis­cus­sions. Two things worth men­tion­ing:

Just to be ex­tra clear, I don’t be­lieve Photobucket in­ten­tion­ally deleted all the im­ages I up­loaded and then asked for $5/mo just be­cause they hate me. While I do re­mem­ber up­load­ing things there as a kid, I bet I was us­ing an even older ac­count.

Just to be ex­tra clear, I don’t be­lieve Photobucket in­ten­tion­ally deleted all the im­ages I up­loaded and then asked for $5/mo just be­cause they hate me. While I do re­mem­ber up­load­ing things there as a kid, I bet I was us­ing an even older ac­count.

It was sug­gested that I re­quest a charge­back from my card. Apparently debit cards also al­low them, did­n’t know this! I might give it a shot, who knows, maybe I’ll end up pay­ing $0 for this story!

It was sug­gested that I re­quest a charge­back from my card. Apparently debit cards also al­low them, did­n’t know this! I might give it a shot, who knows, maybe I’ll end up pay­ing $0 for this story!

…

Ok, no, pay­ing $0 won’t hap­pen. Apparently us­ing Vercel to host a per­sonal blog might not be the best idea (even though it’s a sta­tic site!). I’m nearly reach­ing the limit of Edge Requests in just 2 hours af­ter the post. According to trust­wor­thy Claude, the site will go down if I sur­pass it?…

So I’ll prob­a­bly end up do­ing this2:

No men­tion of any re­funds though, I checked! :P

I was bored. Also, go­ing through a fi­nite list of things and com­plet­ing them one at a time feels sat­is­fy­ing… even pro­duc­tive! However, feels is the cor­rect verb here. ↩

I was bored. Also, go­ing through a fi­nite list of things and com­plet­ing them one at a time feels sat­is­fy­ing… even pro­duc­tive! However, feels is the cor­rect verb here. ↩

And mi­grate to Cloudflare Pages or some­thing, when I have some time to spare. ↩

And mi­grate to Cloudflare Pages or some­thing, when I have some time to spare. ↩

Please en­able JS and dis­able any ad blocker

A few days back I wrote a piece called “AI en­thu­si­asts are in a race against time, AI skep­tics are in a race against en­tropy.”

I have notes on a whole pile of AI-related top­ics that I’d like to cover in depth: AI man­dates, com­mu­ni­ca­tion norms, code re­view, AI art, and more. Unfortunately, I got too many in­ter­est­ing re­sponses to my last piece, and now I have to ad­dress those be­fore I can move on to other top­ics. 😉

There were two types of in­ter­est­ing re­sponses: the first on the tech­ni­cal mer­its, the sec­ond on eth­i­cal grounds. I will re­spond to each of these sep­a­rately. Let’s take the tech­ni­cal side first, be­cause it’s eas­ier.

Somehow, a sub­set of read­ers came away be­liev­ing I was telling every­one to ditch code re­view and push their shit­ti­est code straight into pro­duc­tion with­out read­ing it, right now, tout suite.1

That is not what I am do­ing. That is not what I think you should do. But I did not pick that ex­am­ple at ran­dom, and I will tell you why.

It’s easy to for­get, but for most of 2025, the idea that AI-generated code was slop and might al­ways be slop was not only a rea­son­able po­si­tion to hold, it was the de­fault, main­stream po­si­tion.2

That ques­tion was an­swered de­ci­sively last November. Ever since Opus 4.5 came out, AI has been able to gen­er­ate code that is ap­prox­i­mately as good as that of the me­dian soft­ware en­gi­neer, at least for com­mon pat­terns, and much faster and more cheaply. I came out of a book hole and re­al­ized this in January, and over the first few months of 2026, it seemed like every­one around me was hav­ing a sim­i­lar re­al­iza­tion.

But many saw it com­ing much sooner.

The pop­u­lar nar­ra­tive holds that Opus 4.5 was what changed. But Opus 4.5 was more like the tip­ping point. Agentic har­nesses (the code that wraps the LLM in a loop with tools) be­came a real thing in mid 2025, with pre­cur­sors build­ing back to late 2024. Tool use, func­tion call­ing, MCPs…all of this wave was build­ing over the course of 2025, and crested into real gen­eral pur­pose us­abil­ity at the end of the year.

That’s what the en­thu­si­asts were try­ing to tell us last year. Not only “this is com­ing”, but “this is com­ing faster than you think.”

As it turns out, they were right.

As you may know, I come from the re­li­a­bil­ity side of the house. The com­pli­ment I will pay to my­self and my peo­ple is that we do not strug­gle to adapt to new re­al­i­ties. As soon as a prob­lem is real and in front of us, we ad­just smoothly, even ea­gerly, thanks to an un­whole­some zest for lap­ping up dis­gust­ing tech­ni­cal messes (and the camp­fire tales we get to tell later).

The un-com­pli­ment I will pay my­self and my peo­ple is that we some­times strug­gle to ac­cept that progress is real, that the con­tin­ued ex­is­tence of bugs and edge cases does not di­min­ish the fact that huge swaths of prob­lem space do get more-or-less solved over time, to the point they can be taken for granted by most peo­ple.3

The speed at which code went from to­tal crap to “ah damn, that’s not bad” is what I have in the back of my mind, as en­thu­si­asts are telling us that har­ness en­gi­neer­ing and AI val­i­da­tion is real, it’s al­ready here, and it’s get­ting bet­ter as­ton­ish­ingly fast.

Holding out for “I’ll be­lieve it when I see it” was for­giv­able the first time, but much less so the sec­ond time. This is what it feels like to be on the in­side of an ex­po­nen­tial change curve, turns out.4

I want to pause here and be very clear about what I think is hap­pen­ing. Then I’m go­ing to tell you what specif­i­cally I am ex­cited about, and why.

You are un­der no oblig­a­tion to join me there. But there are way too many sweep­ing state­ments out there right now about “it was never X” — “it was al­ways Y” — “the fu­ture be­longs to xyzzy” 🤮 — and I want to be crys­tal clear how con­di­tional and spe­cific and con­tex­tual my claims are.

What hap­pened in 2025 was this: the eco­nom­ics of code pro­duc­tion were turned up­side down. Instead of be­ing very hard, time-con­sum­ing, and ex­pen­sive to gen­er­ate code, it be­came ef­fec­tively free and in­stant. Lines of code went from be­ing trea­sured, reused, cared for and care­fully cu­rated, to be­ing dis­pos­able and re­gen­er­a­ble, prac­ti­cally overnight.

For most of com­put­ing his­tory, the pri­mary way peo­ple have learned to un­der­stand soft­ware is by writ­ing the code. Once you’ve achieved some mas­tery, read­ing and dis­cussing code gets you most of the way there. (I might ar­gue that soft­ware en­gi­neers have al­ways re­lied far too heav­ily on the code in­stead of sense­mak­ing the sys­tem through ob­serv­abil­ity.)

Many great soft­ware en­gi­neers hold that true prod­uct of every (good) soft­ware en­gi­neer­ing team has al­ways been a shared un­der­stand­ing of the soft­ware we own. That it gets stored as cache state in our frag­ile lit­tle meat brains, fre­quently flushed to disk, de­ployed to pro­duc­tion, com­mit­ted to github, but our minds are where mean­ing has al­ways lived.

Is it any won­der that soft­ware has al­ways been such a fiercely col­lec­tivist en­deavor, ex­quis­itely sen­si­tive to re­la­tion­ship dy­nam­ics and man­ners and ques­tions of fair­ness and emo­tional va­lence? It’s ex­actly what you’d ex­pect when part of your brain lives in other peo­ple’s brains, and your col­lec­tive in­ter­de­pen­dence is sky high.

It’s some­thing that I love about this in­dus­try. But there’s no deny­ing that minds have been a poor con­tainer for cer­tain as­pects of the soft­ware de­vel­op­ment model. We are for­get­ful, dis­tractible, im­pa­tient. We are bad at spot­ting small de­tails, we grow ha­bit­u­ated to rep­e­ti­tion. Worst of all, the model in our heads di­verges mas­sively and per­pet­u­ally from the world our users in­ter­act with.

Anyway, SREs have never quite bought that ex­pla­na­tion. To us, it’s clear that the true prod­uct of every (good) soft­ware en­gi­neer­ing team is pro­duc­tion.

Only prod is prod. Test in prod, or live a lie.

(This is all back­story. I am get­ting to the point, I promise.)

We is­sued our AI man­date last August.5 I had seen enough to know that this was hap­pen­ing, and it was time to do the re­spon­si­ble thing. Honeycomb is a de­v­tools com­pany, and peo­ple come to us to help with hard prob­lems on the fore­front of tech­nol­ogy. I was all in on AI, but I can’t say I was su­per ex­cited about it, in my heart of hearts.6

Then I found Chad Fowler’s writ­ings on Phoenix Architectures.

If you don’t know what I’m talk­ing about, you should hon­estly stop read­ing my shit right now and go read his. Chad is the guy who coined the term “immutable in­fra­struc­ture” in 2013. His best-known es­say is “Relocating Rigor”, be­cause Martin Fowler7 men­tioned it re­cap­ping a Thoughtworks meetup on the fu­ture of soft­ware. I replied with “Production Is Where the Rigor Goes”, com­plain­ing that they did­n’t talk about pro­duc­tion enough.

When I wrote that, I think “Relocating Rigor” was the only piece I had read. But soon I found the rest of it, and af­ter read­ing two or three es­says, it just clicked. I knew ex­actly what he was talk­ing about. I could pre­dict the rest of what he was go­ing to say. And then, reader…then I got ex­cited.

I am go­ing to give you a small sam­ple of Chad quotes, just enough to get the gist. Here’s one from “The Death and Rebirth of Programming”.

Immutable in­fra­struc­ture. Stateless ser­vices. Containers. Blue-green de­ploy­ments. Infrastructure as code.These ideas all share a com­mon premise: never fix a run­ning thing. Replace it.AI pushes this premise be­yond in­fra­struc­ture and into ap­pli­ca­tion code it­self. When rewrit­ing is cheap, edit­ing in place be­comes risky. Mutation ac­cu­mu­lates en­tropy. Replacement re­sets it.

Immutable in­fra­struc­ture. Stateless ser­vices. Containers. Blue-green de­ploy­ments. Infrastructure as code.

These ideas all share a com­mon premise: never fix a run­ning thing. Replace it.

AI pushes this premise be­yond in­fra­struc­ture and into ap­pli­ca­tion code it­self. When rewrit­ing is cheap, edit­ing in place be­comes risky. Mutation ac­cu­mu­lates en­tropy. Replacement re­sets it.

Another fa­vorite: “The Deletion Test”.

Here’s a sim­ple test you can ap­ply to any soft­ware sys­tem you work on:Imag­ine delet­ing the en­tire im­ple­men­ta­tion.Most en­gi­neers ex­pe­ri­ence dele­tion as ex­is­ten­tial. Code feels like the thing. It’s what we write, re­view, ver­sion, de­ploy, and de­bug. Losing it feels like los­ing the sys­tem it­self.When peo­ple say, “We can’t just throw the code away,” what they usu­ally mean is some­thing more pre­cise:We don’t know ex­actly what be­hav­ior is re­quired.We don’t know which fail­ures are un­ac­cept­able.We don’t know what in­vari­ants must al­ways hold.We don’t know how to tell if a new ver­sion is cor­rect.We don’t know which bugs are in­ten­tional fixes for for­got­ten edge cases.Those are not code prob­lems. They are eval­u­a­tion prob­lems.Code be­comes pre­cious when it is the only place knowl­edge lives.

Here’s a sim­ple test you can ap­ply to any soft­ware sys­tem you work on:

Imagine delet­ing the en­tire im­ple­men­ta­tion.

Most en­gi­neers ex­pe­ri­ence dele­tion as ex­is­ten­tial. Code feels like the thing. It’s what we write, re­view, ver­sion, de­ploy, and de­bug. Losing it feels like los­ing the sys­tem it­self.

When peo­ple say, “We can’t just throw the code away,” what they usu­ally mean is some­thing more pre­cise:

We don’t know ex­actly what be­hav­ior is re­quired.

We don’t know ex­actly what be­hav­ior is re­quired.

We don’t know which fail­ures are un­ac­cept­able.

We don’t know which fail­ures are un­ac­cept­able.

We don’t know what in­vari­ants must al­ways hold.

We don’t know what in­vari­ants must al­ways hold.

We don’t know how to tell if a new ver­sion is cor­rect.

We don’t know how to tell if a new ver­sion is cor­rect.

We don’t know which bugs are in­ten­tional fixes for for­got­ten edge cases.

We don’t know which bugs are in­ten­tional fixes for for­got­ten edge cases.

Those are not code prob­lems. They are eval­u­a­tion prob­lems.

Code be­comes pre­cious when it is the only place knowl­edge lives.

and,

For most of soft­ware his­tory, treat­ing code as durable was rea­son­able.We treated code as per­ma­nent be­cause the la­bor to pro­duce it was the bot­tle­neck. Rewriting was ex­pen­sive. Re-validation was risky. Implementations ac­cu­mu­lated mean­ing over time. Structure, tests, com­ments, bug fixes, and tribal knowl­edge fused into some­thing you learned not to dis­turb.That made sense when pro­duc­tion was the con­straint.When re­gen­er­a­tion is easy, code stops be­ing an as­set and starts act­ing as a cache: a ma­te­ri­al­ized view of un­der­stand­ing that is use­ful while cur­rent, dis­pos­able when stale.

For most of soft­ware his­tory, treat­ing code as durable was rea­son­able.

We treated code as per­ma­nent be­cause the la­bor to pro­duce it was the bot­tle­neck. Rewriting was ex­pen­sive. Re-validation was risky. Implementations ac­cu­mu­lated mean­ing over time. Structure, tests, com­ments, bug fixes, and tribal knowl­edge fused into some­thing you learned not to dis­turb.

That made sense when pro­duc­tion was the con­straint.

When re­gen­er­a­tion is easy, code stops be­ing an as­set and starts act­ing as a cache: a ma­te­ri­al­ized view of un­der­stand­ing that is use­ful while cur­rent, dis­pos­able when stale.

“A ma­te­ri­al­ized view of un­der­stand­ing that is use­ful while cur­rent, dis­pos­able when stale.” I think that might have been the ex­act line that made it click in my head.

I am just barely old enough that my first job ti­tle was “System Administrator”. I was a teenager, work­ing at the uni­ver­sity, with root on every ma­chine in the days be­fore they learned they should def­i­nitely not do that.8

I lived through the shift from hand­crafted server pets to im­mutable in­fra­struc­ture cat­tle. I did­n’t re­ally un­der­stand what was hap­pen­ing at the time, but I’ve con­tem­plated it a lot in re­cent years. I wrote this in the fi­nal chap­ter of “Observability Engineering”, 2nd edi­tion (available for down­load as of Wednesday, June 17th!):

The shift from hand­crafted servers to im­mutable in­fra­struc­ture taught us that mu­ta­bil­ity is the sworn en­emy of un­der­stand­ing. Any ar­ti­fact that is edited in place cre­ates drift. Drift is what makes sys­tems im­pos­si­ble to main­tain.Our abil­ity to kill and re­gen­er­ate in­fra­struc­ture com­po­nents is the rea­son we trust it. At Honeycomb, we kill the old­est Kafka node off via cron every Tuesday. That’s why we are con­fi­dent in our boot­strap­ping and bal­anc­ing processes: every­thing is re­peat­able, the data can be re­gen­er­ated, the com­mit­ments live else­where.The fact that we can­not re­gen­er­ate our code in the same way is a sign that we do not un­der­stand it. We do not know which com­mit­ments we have made, we do not know which de­pen­den­cies will break. We find them by break­ing them, mostly.

The shift from hand­crafted servers to im­mutable in­fra­struc­ture taught us that mu­ta­bil­ity is the sworn en­emy of un­der­stand­ing. Any ar­ti­fact that is edited in place cre­ates drift. Drift is what makes sys­tems im­pos­si­ble to main­tain.

Our abil­ity to kill and re­gen­er­ate in­fra­struc­ture com­po­nents is the rea­son we trust it. At Honeycomb, we kill the old­est Kafka node off via cron every Tuesday. That’s why we are con­fi­dent in our boot­strap­ping and bal­anc­ing processes: every­thing is re­peat­able, the data can be re­gen­er­ated, the com­mit­ments live else­where.

The fact that we can­not re­gen­er­ate our code in the same way is a sign that we do not un­der­stand it. We do not know which com­mit­ments we have made, we do not know which de­pen­den­cies will break. We find them by break­ing them, mostly.

Think of all the years of your work­ing life you have wasted on painful mi­gra­tions and rewrites. Think of re­plac­ing load-bear­ing legacy code. Think of all the stran­gler figs.

Lines of code have been do­ing too much. The code has been the bun­dled up repos­i­tory of de­vel­oper in­tent, user ex­pec­ta­tions, im­plicit and ex­plicit be­hav­iors, the only fos­silized com­pos­ite record we have of bugs gone by. It’s too much!

And look at all the do­mains that have been ne­glected due to the tow­er­ing, all-con­sum­ing ex­pense of main­tain­ing and mu­tat­ing lines of code. Where are the ar­ti­facts I can re­view and dis­cuss to un­der­stand how our ar­chi­tec­ture is evolv­ing? Where are our ar­chi­tec­ture ar­ti­facts, pe­riod? What if we could dis­cuss and con­verge on an ar­chi­tec­ture di­a­gram, and the code could be re­gen­er­ated from changes to the ar­chi­tec­ture, in­stead of the ar­chi­tec­ture be­ing kinda-sorta in­ferred from the code?

I am not as­sert­ing that all code will even­tu­ally be AI-generated to spec, by­pass­ing hu­man un­der­stand­ing. The fea­si­bil­ity of this whole en­deavor hangs on the ques­tion of what a spec is, or what a spec could be. Anyone who has ever done a painful data­base mi­gra­tion should have learned some god­damn hu­mil­ity about our abil­ity to ex­tract and for­mal­ize users’ ex­pec­ta­tions in a re­playable, au­to­mate-able way.

But I think that every step we can take in that di­rec­tion will be good for us.

The tools to do this don’t ex­ist yet, but many of the ideas do ex­ist. Most come from op­er­a­tions and QA, two do­mains that soft­ware en­gi­neer­ing has his­tor­i­cally been rather snob­bish about.

Those tests and tech­niques are not about test­ing for cor­rect­ness or what ought to be hap­pen­ing, they are about ob­serv­ing and en­cod­ing what is hap­pen­ing. Behavioral tests, char­ac­ter­i­za­tion tests, cap­ture/​re­play, traf­fic split­ters. Observability (the good kind).

Having non­de­ter­min­is­tic code in pro­duc­tion is fi­nally forc­ing us to do the things we should have done all along. Instrumenting with traces. Tests and evals in pro­duc­tion. Production is not what hap­pens af­ter de­vel­op­ment is over, pro­duc­tion is a stage of de­vel­op­ment.

Human brains are not good at val­i­da­tion. The nit­pick­i­ness, the rep­e­ti­tion. This is the worst thing to be cling­ing to, y’all. There are so many bet­ter things for us to want to pre­serve and as­sert for our­selves in the pro­duc­tion and main­te­nance of soft­ware. We are never go­ing to beat the ma­chine when it comes to val­i­da­tion — we are lit­er­ally the weak­est link!

My mon­ey’s on hu­mans for a good long time when it comes to cre­ativ­ity, in­spi­ra­tion, leaps of logic, and a lot of other things, but PLEASE do not rest your killer ar­gu­ment for hu­mans in soft­ware on us be­ing the best qual­ity gate. OMG. 🙈

Alright. I’m al­most done here. Just one more thing.

I think what many en­gi­neers have found so alien­at­ing and ter­ri­fy­ing about the last two years of AI dis­course has been the way so many promi­nent AI voices ap­pear to be glee­fully de­clar­ing that soft­ware is no longer an en­gi­neer­ing prob­lem. “SaaS is dead!” “Making AI great at cod­ing was the strat­egy that un­locks every­thing else”, and so on. Even Adam Jacob, one of my dear­est friends and some­one who is rarely wrong about tech­nol­ogy, seems to an­tic­i­pate a blood­bath of soft­ware jobs.9

If 2025 was the year of vibe cod­ing, where AI got as good at gen­er­at­ing lines of code as the me­dian soft­ware en­gi­neer, and the range of pos­si­ble fu­tures of­ten felt desta­bi­liz­ingly, im­pos­si­bly wide open, I feel like 2026 is shap­ing up to be a re­turn to dis­ci­pline.

The knowl­edge in our heads is un­avail­able to AI un­til we en­code it into the sys­tem, af­ter all. The re­turns on those in­vest­ments will be mas­sive and non­lin­ear. We might ar­gue that they al­ways would have paid for them­selves in the long run. But now every CEO in ex­is­tence is chomp­ing at the bit to get some of those AI cook­ies, so let’s give it to them. Discipline first, cook­ies sec­ond.

The share of soft­ware en­gi­neer­ing teams that work in short, fast feed­back loops (the car­di­nal sign of dis­ci­pline in my book) is, and al­ways has been, ap­pallingly small. Five per­cent, maybe? Definitely less than 10%. AI tool­ing brings this more within reach than ever be­fore. Or it can. It could. The dis­con­tin­u­ous re­turns on in­vest­ment in en­gi­neer­ing dis­ci­pline are real enough that it just might hap­pen.

I am not wor­ried, at least in the near term, about AI cre­at­ing mas­sive, dis­con­tin­u­ous re­turns on in­vest­ment in the ab­sence of en­gi­neer­ing dis­ci­pline. (Many will try, and it will be en­ter­tain­ing to watch.)

But value is backed by dura­bil­ity, not dis­pos­abil­ity, and I don’t see that chang­ing. Bits are cheap and fast and gov­erned by the rules of logic and lan­guage, but any­thing with value must ul­ti­mately re­solve with phys­i­cal sys­tems: per­sis­tence on the one side, user ex­pe­ri­ence on the other.

People do not want to wake up every day and log in to Slack and find the but­tons and menus all sub­tly moved around. People do not want fi­nan­cial trans­ac­tions that com­plete most of the time. Determinism is not go­ing any­where, my friends.

AI is not magic. This is still en­gi­neer­ing. As Adam says, “it’s still tech­nol­ogy, and tech­nol­ogy needs tech­nol­o­gists.” And I for one am look­ing for­ward to learn­ing new and in­ter­est­ing en­gi­neer­ing prob­lems, re­view­ing dif­fer­ent kinds of ar­ti­facts.

And never do­ing an­other sticky, picky, two year long API rewrite or stran­gler fig mi­gra­tion, ever, ever again.

~charity

P.S. Thanks to every­one who read a draft and gave me feed­back: Dave Williams, Chad Fowler, Adam Jacob, Mark Ferlatte, Austin Parker, Erwin van der Koogh, Ankur Bhatt.

1

I was not try­ing to be neu­tral or even-handed in my last piece, only to give a base­line of cour­tesy to every­one. But I think it’s re­veal­ing how many times I was ac­cused of be­ing “so overly hard on skep­tics”, by skep­tics, and “so overly hard on en­thu­si­asts”, by en­thu­si­asts, and some­times sim­ply “It’s sad how some peo­ple can’t ac­cept re­al­ity” with no in­di­ca­tion which side they meant. Lord.

2

Fred Hebert and I gave the clos­ing keynote at SRECon in March of 2025 where we told SREs they should get to know AI, maybe even try vibe cod­ing (pause for laughs), be­cause oth­er­wise their cri­tiques would­n’t land as well.

Seriously, that was our big pitch. Learn AI so that you can com­plain more ef­fec­tively.

3

Infrastructure, for ex­am­ple. I think this is true of a lot of en­gi­neers, btw. I just think it’s re­ally re­ally true of the type of en­gi­neer that signs up to be an SRE. Technological pes­simism and ADHD, our two most defin­ing traits.

4

There is a seg­ment of AI en­thu­si­asts who be­lieve we are en­ter­ing an era of eter­nal ex­po­nen­tial growth, in which the ma­chines be­gin to build bet­ter and bet­ter ma­chines, in ways we can­not un­der­stand.

I think those peo­ple are bad at math. The only thing we know for cer­tain about ex­po­nen­tial growth is that it will end. It al­ways does. ei­ther in an S curve or a crash. (For a good time, google Heinz van Foerster and “our great-great grand­chil­dren will be squeezed to death.”)

I def­i­nitely think we will use ma­chines to build the ma­chines — duh, we al­ready are — but that’s about re­cur­sion and spe­cial­iza­tion. I think the ex­po­nen­tial curve we are on the in­side of now was cre­ated by sloshy free money chas­ing high re­turns, plus the prop­er­ties of soft­ware as a func­tion of lan­guage and logic, plus the biggest dis­cov­er­ies al­ways hap­pen in the early days of a tech­nol­ogy boom, be­cause low hang­ing fruit gets picked first.

My per­sonal sense — and keep in mind that I am no kind of ex­pert on AI — is that the ex­po­nen­tial ad­vance­ment in AI mod­els lev­eled out a while ago, and gains are be­com­ing harder to earn and more in­cre­men­tal in na­ture. I may turn out to be very wrong, of course. But even if there were no more AI in­no­va­tions mov­ing for­wards, the past year has un­leashed enough pent-up force to rad­i­cally re­shape the soft­ware in­dus­try as we know it. Like a pig in a python, we will be deal­ing with the con­se­quences for a long time to come.

5

Despite the fact that AI in­creas­ingly dom­i­nates our econ­omy (it’s a hot IPO sum­mer and we’re all just along for the ride), most Americans are not par­tic­u­larly op­ti­mistic about the tech­nol­o­gy’s long-term im­pact on the coun­try, a new study from Pew Research re­veals.

In fact, al­though a whole lot of Americans in­creas­ingly use AI in their daily lives, most of them have neu­tral to neg­a­tive views about it, the re­search re­veals.

Only 16% of Americans think that AI’s im­pact on so­ci­ety dur­ing the next 20 years will be pos­i­tive, Pew says, while around 40% say that it will have a neg­a­tive im­pact.

A vast ma­jor­ity of peo­ple (67%) don’t be­lieve that the U.S. gov­ern­ment will do any­thing to mean­ing­fully reg­u­late AI. A sim­i­larly skep­ti­cal co­hort (59%) don’t trust com­pa­nies to de­velop it safely.

Young peo­ple — that is, those peo­ple un­der 30 — are the ones with the most neg­a­tive feel­ings about AI. Pew says that only 14% of this co­hort be­lieve the tech will have a pos­i­tive im­pact on so­ci­ety.

On top of all this, a vast ma­jor­ity of Americans — nearly two-thirds — also think that AI’s de­vel­op­ment is oc­cur­ring too quickly.

Despite all of the skep­ti­cism, a whole lot of Americans also re­port us­ing AI in their daily lives on an in­creas­ingly reg­u­lar ba­sis. About a quar­ter of Americans say they use AI chat­bots on a daily ba­sis. Those who do are typ­i­cally us­ing the chat­bots for re­search pur­poses or for work, Pew says.

A vast ma­jor­ity of peo­ple us­ing AI are us­ing ChatGPT. Pew writes that 44% of U.S. adults now say they use OpenAI’s chat­bot, a fig­ure that’s more than dou­bled since 2023.

The next most pop­u­lar chat­bot is Gemini (24%), fol­lowed by Copilot (17%) and Meta AI (14%), with Grok (8%), Claude (6%), and Character.ai (3%) lag­ging be­hind.

There is a bit of a gen­der di­vide. While chat­bot use is grow­ing for both men and women, men still use AI more and are more en­thu­si­as­tic about it, while women are more skep­ti­cal, Pew says. Men are more likely to say they use AI chat­bots in their daily lives (27% ver­sus 20% for women) and while equal shares of men and women re­port us­ing ChatGPT, men more com­monly re­port us­age of other brands, such as Copilot and Grok.

The re­port also high­lights how AI is chang­ing the ways Americans con­sume in­for­ma­tion. Six in 10 sur­vey re­spon­dents told Pew that they rou­tinely read AI-generated in­ter­net sum­maries (indeed, on Google, they’re pretty much un­avoid­able). A much smaller num­ber re­port us­ing AI to get in­for­ma­tion on fit­ness and di­et­ing.

There are also still a whole lot of peo­ple — about half of the coun­try — that say they do not use AI in their daily lives. The peo­ple who do not use AI tend to be older, while those un­der 50 are more likely to say that they use it. Nearly 75% of Americans aged 65 or older say that they never use AI chat­bots.

Those peo­ple who don’t use chat­bots say they don’t be­cause they’re not in­ter­ested in them, and add that they have no in­ten­tion of us­ing them in the fu­ture.

When you pur­chase through links in our ar­ti­cles, we may earn a small com­mis­sion. This does­n’t af­fect our ed­i­to­r­ial in­de­pen­dence.

Lucas is a se­nior writer at TechCrunch, where he cov­ers ar­ti­fi­cial in­tel­li­gence, con­sumer tech, and star­tups. He pre­vi­ously cov­ered AI and cy­ber­se­cu­rity at Gizmodo.

You can con­tact Lucas by email­ing lu­cas.ropek@techcrunch.com.

View Bio

Abstract

This spec­i­fi­ca­tion de­fines the QUERY method for HTTP. A QUERY re­quests that the re­quest tar­get process the en­closed con­tent in a safe and idem­po­tent man­ner and then re­spond with the re­sult of that pro­cess­ing. This is sim­i­lar to POST re­quests, but QUERY re­quests can be au­to­mat­i­cally re­peated or restarted with­out con­cern for par­tial state changes.¶

Status of This Memo

This is an Internet Standards Track doc­u­ment.¶

This doc­u­ment is a prod­uct of the Internet Engineering Task Force (IETF). It rep­re­sents the con­sen­sus of the IETF com­mu­nity. It has re­ceived pub­lic re­view and has been ap­proved for pub­li­ca­tion by the Internet Engineering Steering Group (IESG). Further in­for­ma­tion on Internet Standards is avail­able in Section 2 of RFC 7841.¶

Information about the cur­rent sta­tus of this doc­u­ment, any er­rata, and how to pro­vide feed­back on it may be ob­tained at https://​www.rfc-ed­i­tor.org/​info/​rfc10008.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the per­sons iden­ti­fied as the doc­u­ment au­thors. All rights re­served.¶

This doc­u­ment is sub­ject to BCP 78 and the IETF Trust’s Legal Provisions Relating to IETF Documents (https://​trustee.ietf.org/​li­cense-info) in ef­fect on the date of pub­li­ca­tion of this doc­u­ment. Please re­view these doc­u­ments care­fully, as they de­scribe your rights and re­stric­tions with re­spect to this doc­u­ment. Code Components ex­tracted from this doc­u­ment must in­clude Revised BSD License text as de­scribed in Section 4.e of the Trust Legal Provisions and are pro­vided with­out war­ranty as de­scribed in the Revised BSD License.¶

1. Introduction

This spec­i­fi­ca­tion de­fines the HTTP QUERY re­quest method as a means of mak­ing a safe, idem­po­tent re­quest (Section 9.2 of [HTTP]) that en­closes a rep­re­sen­ta­tion de­scrib­ing how the re­quest is to be processed by the tar­get re­source.¶

A com­mon query pat­tern is:¶

However, when the data con­veyed is too vo­lu­mi­nous to be en­coded in the re­quest’s URI, this pat­tern be­comes prob­lem­atic:¶

As an al­ter­na­tive to us­ing GET, many im­ple­men­ta­tions make use of the HTTP POST method to per­form queries, as il­lus­trated in the ex­am­ple be­low. In this case, the in­put to the query op­er­a­tion is passed as the re­quest con­tent as op­posed to us­ing the re­quest URI’s query com­po­nent.¶

A typ­i­cal use of HTTP POST for re­quest­ing a query is:¶

In this vari­a­tion, how­ever, it is not read­ily ap­par­ent — with­out spe­cific knowl­edge of the re­source and server to which the re­quest is be­ing sent — that a safe, idem­po­tent query is be­ing per­formed.¶

The QUERY method pro­vides a so­lu­tion that spans the gap be­tween the use of GET and POST, with the ex­am­ple above be­ing ex­pressed as:¶

As with POST, the in­put to the query op­er­a­tion is passed as the con­tent of the re­quest rather than as part of the re­quest URI. Unlike POST, how­ever, the method is ex­plic­itly safe and idem­po­tent, al­low­ing func­tions like caching and au­to­matic re­tries to op­er­ate.¶

Recognizing the de­sign prin­ci­ple that any im­por­tant re­source ought to be iden­ti­fied by a URI, this spec­i­fi­ca­tion de­scribes how a server can as­sign URIs to both the query it­self or to a spe­cific query re­sult, for later use in a GET re­quest.¶

Summarizing:¶

1.1. Terminology

This doc­u­ment uses ter­mi­nol­ogy de­fined in Section 3 of [HTTP].¶

Furthermore, it uses the terms URI query pa­ra­me­ter for pa­ra­me­ters in the query com­po­nent of a URI (Section 4.2.2 of [HTTP]) and query con­tent for the re­quest con­tent (Section 6.4 of [HTTP]) of a QUERY re­quest.¶

1.2. Notational Conventions

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “NOT RECOMMENDED”, “MAY”, and “OPTIONAL” in this doc­u­ment are to be in­ter­preted as de­scribed in BCP 14 [RFC2119] [RFC8174] when, and only when, they ap­pear in all cap­i­tals, as shown here.¶

2. QUERY Method

The QUERY method is used to ini­ti­ate a server-side query. Unlike the GET method, which re­quests a rep­re­sen­ta­tion of the re­source iden­ti­fied by the tar­get URI (as de­fined by Section 7.1 of [HTTP]), the QUERY method is used to ask the tar­get re­source to per­form a query op­er­a­tion within the scope of that tar­get re­source.¶

The con­tent of the re­quest and its me­dia type de­fine the query. The ori­gin server de­ter­mines the scope of the op­er­a­tion based on the tar­get re­source.¶

Servers MUST fail the re­quest if the Content-Type re­quest field ([HTTP], Section 8.3) is miss­ing or is in­con­sis­tent with the re­quest con­tent.¶

As for all HTTP meth­ods, the tar­get URI’s query part takes part in iden­ti­fy­ing the re­source be­ing queried. Whether and how it di­rectly af­fects the re­sult of the query is spe­cific to the re­source and is out of scope for this spec­i­fi­ca­tion.¶

QUERY re­quests are safe with re­gard to the tar­get re­source ([HTTP], Section 9.2.1); that is, the client does not re­quest or ex­pect any change to the state of the tar­get re­source. This does not pre­vent the server from cre­at­ing ad­di­tional HTTP re­sources through which ad­di­tional in­for­ma­tion can be re­trieved (see Sections 2.3 and 2.4).¶

Furthermore, QUERY re­quests are idem­po­tent ([HTTP], Section 9.2.2); they can be re­tried or re­peated when needed, for in­stance, af­ter a con­nec­tion fail­ure.¶

As per Section 15.3 of [HTTP], a 2xx (Successful) re­sponse code sig­nals that the re­quest was suc­cess­fully re­ceived, un­der­stood, and ac­cepted.¶

In par­tic­u­lar, a 200 (OK) re­sponse in­di­cates that the query was suc­cess­fully processed and the re­sults of that pro­cess­ing are en­closed as the re­sponse con­tent.¶

2.2. Equivalent Resource

The equiv­a­lent re­source for any given QUERY re­quest is a re­source that re­sponds to GET re­quests, rep­re­sents that QUERY re­quest and its tar­get, and takes both mes­sage con­tent and meta­data into ac­count (Section 6 of [HTTP]). In par­tic­u­lar, this in­cludes rep­re­sen­ta­tion meta­data (Section 8 of [HTTP]) such as the con­tent’s me­dia type.¶

In other words, the equiv­a­lent re­source is de­rived from the re­source im­ple­ment­ing QUERY by in­cor­po­rat­ing the re­quest con­tent.¶

The term equiv­a­lent re­source is used as a means to de­fine be­hav­ior for other HTTP as­pects, such as se­lected rep­re­sen­ta­tions. Servers can but do not have to as­sign URIs to these re­sources (see Section 1.1 of [URI]). If they do so, these re­sources will be­come ac­ces­si­ble for GET re­quests.¶

2.3. Content-Location Response Field

A suc­cess­ful re­sponse (2xx, Section 15.3 of [HTTP]) can in­clude a Content-Location header field con­tain­ing an iden­ti­fier for a re­source cor­re­spond­ing to the re­sults of the op­er­a­tion; see Section 8.7 of [HTTP] for de­tails. This rep­re­sents a claim from the server that a client can send a GET re­quest for the in­di­cated URI to re­trieve the re­sults of the query op­er­a­tion just per­formed. The in­di­cated re­source might be tem­po­rary.¶

See Appendix A.4.1 for an ex­am­ple.¶

2.4. Location Response Field

A server can as­sign a URI to the equiv­a­lent re­source (Section 2.2) of a QUERY re­quest. If the server does so, the URI of that re­source can be in­cluded in the Location header field of the 2xx re­sponse (see Section 10.2.2 of [HTTP]). This rep­re­sents a claim that a client can send a GET re­quest to the in­di­cated URI to re­peat the query op­er­a­tion just per­formed with­out re­send­ing the query con­tent. This re­source’s URI might be tem­po­rary; if a fu­ture re­quest fails, the client can retry us­ing the orig­i­nal QUERY re­quest tar­get and the pre­vi­ously sub­mit­ted con­tent.¶

See Appendix A.4.2 for an ex­am­ple.¶

2.5. Redirection

In some cases, the server may choose to re­spond in­di­rectly to the QUERY re­quest by redi­rect­ing the user agent to a dif­fer­ent URI (see Section 15.4 of [HTTP]).¶

A re­sponse with ei­ther sta­tus codes 301 (Moved Permanently, [HTTP], Section 15.4.2) or 308 (Permanent Redirect, [HTTP], Section 15.4.9) in­di­cates that the tar­get re­source has per­ma­nently moved to a dif­fer­ent URI ref­er­enced by the Location re­sponse field ([HTTP], Section 10.2.2). Likewise, a re­sponse with ei­ther sta­tus codes 302 (Found, [HTTP], Section 15.4.3) or 307 (Temporary Redirect, [HTTP], Section 15.4.8) in­di­cates that the tar­get re­source has tem­porar­ily moved. In all four cases, the server is sug­gest­ing that the user agent can ac­com­plish its orig­i­nal QUERY re­quest by send­ing a sim­i­lar QUERY re­quest to the new tar­get URI ref­er­enced by the Location.¶

Note that the ex­cep­tions for redi­rect­ing a POST as a GET re­quest af­ter a 301 or 302 re­sponse do not ap­ply to QUERY re­quests.¶

A re­sponse to QUERY with the sta­tus code 303 (See Other, Section 15.4.4 of [HTTP]) in­di­cates that the orig­i­nal query can be ac­com­plished via a nor­mal re­trieval re­quest on the URI ref­er­enced by the Location re­sponse field ([HTTP], Section 10.2.2). For HTTP, this means send­ing a GET re­quest to the new tar­get URI, as il­lus­trated by the ex­am­ple in Appendix A.4.3.¶

2.6. Conditional Requests

The se­lected rep­re­sen­ta­tion (Section 3.2 of [HTTP]) of a QUERY re­quest is the same as for a GET re­quest to the equiv­a­lent re­source (Section 2.2) of that QUERY re­quest.¶

A con­di­tional QUERY re­quests that the se­lected rep­re­sen­ta­tion (i.e., the query re­sults af­ter any con­tent ne­go­ti­a­tion) be re­turned in the re­sponse only un­der the cir­cum­stances de­scribed by the con­di­tional header field(s), as de­fined in Section 13 of [HTTP].¶

See Appendix A.5 for ex­am­ples.¶

2.7. Caching

The re­sponse to a QUERY method is cacheable; a cache MAY use it to sat­isfy sub­se­quent QUERY re­quests as per Section 4 of [HTTP-CACHING].¶

The cache key for a QUERY re­quest (Section 2 of [HTTP-CACHING]) MUST in­cor­po­rate the re­quest con­tent (Section 6 of [HTTP-CACHING]) and re­lated meta­data (Section 8 of [HTTP]).¶

To im­prove cache ef­fi­ciency, caches MAY re­move se­man­ti­cally in­signif­i­cant dif­fer­ences from re­quest con­tent and re­lated meta­data first. For in­stance, by:¶

Note that any such trans­for­ma­tion is per­formed solely for the pur­pose of gen­er­at­ing a cache key; it does not change the re­quest it­self.¶

Clients can in­di­cate, us­ing the “no-transform” cache di­rec­tive (Section 5.2.1.6 of [HTTP-CACHING]) that they wish that no such trans­for­ma­tion hap­pens (but note that this di­rec­tive is just ad­vi­sory).¶

Note that caching QUERY method re­sponses is in­her­ently more com­plex than caching re­sponses to GET, as com­plete read­ing of the re­quest’s con­tent is needed in or­der to de­ter­mine the cache key. If a QUERY re­sponse sup­plies a Location re­sponse field (Section 2.4) to in­di­cate a URI for an equiv­a­lent re­source (Section 2.2), clients can switch to GET for sub­se­quent re­quests, thereby sim­pli­fy­ing pro­cess­ing.¶

2.8. Range Requests

The se­man­tics of Range Requests for QUERY are iden­ti­cal to those for GET, as de­fined in Section 14 of [HTTP]. Byte Range Requests (the only range unit de­fined at the time of writ­ing), how­ever, of­fer lit­tle value for the re­sults of a QUERY re­quest.¶

Query for­mats of­ten de­fine their own way of lim­it­ing or pag­ing through re­sult sets, such as with “FETCH FIRST … ROWS ONLY” in SQL. It is ex­pected that these built-in fea­tures will be used in­stead of HTTP Range Requests.¶

The “Accept-Query” re­sponse header field can be used by a re­source to di­rectly sig­nal sup­port for the QUERY method while iden­ti­fy­ing the spe­cific query for­mat me­dia type(s) that may be used.¶

Accept-Query con­tains a list of me­dia ranges (Section 12.5.1 of [HTTP]) us­ing “Structured Fields” syn­tax [STRUCTURED-FIELDS]. Media ranges are rep­re­sented by a List Structured Header Field of ei­ther Tokens or Strings, con­tain­ing the me­dia range value with­out pa­ra­me­ters.¶

Media type pa­ra­me­ters, if any, are mapped to Structured Field Parameters with the String or Token type. The choice of Token ver­sus String is se­man­ti­cally in­signif­i­cant. That is, re­cip­i­ents MAY con­vert Tokens to Strings, but MUST NOT process them dif­fer­ently based on the re­ceived type.¶

Media types do not ex­actly map to Tokens; for in­stance, they al­low a lead­ing digit. In cases like these, the String for­mat needs to be used.¶

The only sup­ported uses of wild­cards are “*/*”, which matches any type, or “xxxx/*”, which matches any sub­type of the in­di­cated type.¶

The or­der of types listed in the field value is not sig­nif­i­cant.¶

The value of the Accept-Query field ap­plies to every URI on the server that shares the same path; in other words, the query com­po­nent is ig­nored. If re­quests to the same re­source re­turn dif­fer­ent Accept-Query val­ues, the most re­cently re­ceived fresh value (per Section 4.2 of [HTTP-CACHING]) is used.¶

For ex­am­ple:¶

Although the syn­tax for this field ap­pears to be sim­i­lar to other fields, such as “Accept” (Section 12.5.1 of [HTTP]), it is a Structured Field and thus MUST be processed as spec­i­fied in Section 4 of [STRUCTURED-FIELDS].¶

4. Security Considerations

The QUERY method is sub­ject to the same gen­eral se­cu­rity con­sid­er­a­tions as all HTTP meth­ods as de­scribed in [HTTP].¶

It can be used as an al­ter­na­tive to pass­ing re­quest in­for­ma­tion in the URI (e.g., in the query com­po­nent). This is pre­ferred in some cases, as the URI is more likely to be logged or oth­er­wise processed by in­ter­me­di­aries than the re­quest con­tent. In other cases, where the query con­tains sen­si­tive in­for­ma­tion, the po­ten­tial for log­ging of the URI might mo­ti­vate the use of QUERY over GET.¶

If a server cre­ates a tem­po­rary re­source to rep­re­sent the re­sults of a QUERY re­quest (e.g., for use in the Location or Content-Location field), as­signs a URI to that re­source, and the re­quest con­tains sen­si­tive in­for­ma­tion that can­not be logged, then that URI SHOULD be cho­sen such that it does not in­clude any sen­si­tive por­tions of the orig­i­nal re­quest con­tent.¶

Caches that nor­mal­ize QUERY con­tent in­cor­rectly or in ways that are sig­nif­i­cantly dif­fer­ent from how the re­source processes the con­tent can re­turn an in­cor­rect re­sponse if nor­mal­iza­tion re­sults in a false pos­i­tive.¶

A QUERY re­quest from user agents im­ple­ment­ing Cross-Origin Resource Sharing (CORS) will re­quire a “preflight” re­quest, as QUERY does not be­long to the set of CORS-safelisted meth­ods (see [FETCH]).¶

5. IANA Considerations

5.1. Registration of the QUERY Method

IANA has added the QUERY method to the “Hypertext Transfer Protocol (HTTP) Method Registry” at <http://​www.iana.org/​as­sign­ments/​http-meth­ods> (see Section 16.3.1 of [HTTP]).¶

5.2. Registration of the Accept-Query Field

IANA has added the Accept-Query field to the “Hypertext Transfer Protocol (HTTP) Field Name Registry” at <https://​www.iana.org/​as­sign­ments/​http-fields> (see Section 16.1.1 of [HTTP]).¶

6. References

6.1. Normative References

6.2. Informative References

Appendix A. Examples

The ex­am­ples be­low are for il­lus­tra­tive pur­poses only; if one needs to send queries that are ac­tu­ally this short, it is likely bet­ter to use GET.¶

The me­dia type used in most ex­am­ples is “application/x-www-form-urlencoded” (as used in POST re­quests from browser user clients, de­fined in “application/x-www-form-urlencoded” in [URL]). The Content-Length fields have been omit­ted for brevity.¶

A.1. Simple Query

Below is a sim­ple query with a di­rect re­sponse:¶

Response:¶

A.2. Discovery of QUERY Support

A sim­ple way to dis­cover sup­port for QUERY is pro­vided by the OPTIONS (Section 9.3.7 of [HTTP]) method:¶

Response:¶

The Allow re­sponse field (Section 10.2.1 of [HTTP]) de­notes the set of sup­ported meth­ods on the spec­i­fied re­source.¶

There are al­ter­na­tives to the use of OPTIONS. For in­stance, a QUERY re­quest can be tried with­out prior knowl­edge of server sup­port. The server would then ei­ther process the re­quest, or it could re­spond with a 4xx sta­tus such as 405 (Method Not Allowed, Section 15.5.6 of [HTTP]), in­clud­ing the Allow re­sponse field.¶

A.3. Discovery of QUERY Formats

The dis­cov­ery of sup­ported me­dia types for QUERY is pos­si­ble via the Accept-Query re­sponse field (Section 3):¶

Response:¶