RPC over HTTP pretty much always goes through POST, sometimes with the option of using GET for querying as an optimisation.

For graphql specifically, if you allow GET-ing the GraphQL endpoint (which usually isn't the case by default), it's trivial to ensure only queries go through that method.