Essentially correct, QUERY is safe, like GET, not merely idempotent, like PUT. Safety implies idempotence, but not vice versa.

Does “safe” here mean just “non-mutating”?

	▲	dragonwriter 14 minutes ago \| parent [-]
		No, it doesn't just mean that (it does mean non-mutating from the point of view of the client and in regard to the target resource, but the essential meaning involves more than that and it is more subtle than simply “non-mutating”.) The specific definition is in the HTTP spec, and I don't think I can describe it more concisely without losing important information necessary for really understanding it. https://www.rfc-editor.org/rfc/rfc9110#section-9.2.1