REST API GET with sensitive data : <p>I'm designing api with method that should be an <strong>idempotent</strong>, and should not modify any data on the server. It should be method that process request and return response for given parameters. </p>

<p>One of the parameters is sensitive data. It's not an option to use additional encryption. Data is already encrypted, but security requirements are very demanding and even encrypted data should be treated very carefully.</p>

<p>According to REST spec, idempotent query method should be implemented as a GET HTTP method. Problem in this case is sensitive data that shouldn't be pass as a GET parameter in URL. Only option in HTTP standard is to pass sensitive data in a body part of HTTP request.</p>

<p>My question is what is better? Broke rest api design, and send query request as a POST, or pass encrypted data in URL? Maybe is there better solution I don't see?</p>
