yeah good catch, my response was incomplete. QUERY is a POST that is not only idempotent but also safe (it does not change anything at all on the server) (and it's cacheable of course)

PUT is idempotent but not safe.