From 4172b8788b016f67eafbed631ae9c583c6ad3077 Mon Sep 17 00:00:00 2001
From: Carl Suster <carl.suster@sydney.edu.au>
Date: Tue, 3 Mar 2026 16:25:18 +1100
Subject: [PATCH 1/2] req_body_form() sets req to an empty list

---
 R/req-body.R                   | 2 +-
 tests/testthat/test-req-body.R | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/R/req-body.R b/R/req-body.R
index 129ced22..9fa78fc9 100644
--- a/R/req-body.R
+++ b/R/req-body.R
@@ -156,7 +156,7 @@ req_body_form <- function(
   check_request(.req)
 
   dots <- multi_dots(..., .multi = .multi)
-  data <- modify_list(.req$body$data, !!!dots)
+  data <- modify_list(.req$body$data %||% list(), !!!dots)
   req_body(.req, data = data, type = "form")
 }
 
diff --git a/tests/testthat/test-req-body.R b/tests/testthat/test-req-body.R
index c56f318d..2e0e790b 100644
--- a/tests/testthat/test-req-body.R
+++ b/tests/testthat/test-req-body.R
@@ -197,6 +197,13 @@ test_that("form data is unobufcated", {
   expect_equal(rawToChar(req$options$postfields), 'x=x&y=y')
 })
 
+test_that("empty form data gives a valid request", {
+  req <- request_test() |>
+    req_body_form() |>
+    req_body_apply()
+  expect_equal(req$body$data, list())
+})
+
 # req_body_multipart() ---------------------------------------------------------
 
 test_that("can send named elements as multipart", {

From 73961743ee26268ca34fbaad0893b238f6995479 Mon Sep 17 00:00:00 2001
From: Carl Suster <carl.suster@sydney.edu.au>
Date: Wed, 4 Mar 2026 08:43:19 +1100
Subject: [PATCH 2/2] Update NEWS for #836

---
 NEWS.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/NEWS.md b/NEWS.md
index 5403f96e..5015749b 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -3,6 +3,8 @@
 * `oauth_flow_auth_code()` now correctly uses the same redirect URI for both authorization and token requests when using the default localhost redirect URL (@pedrobtz, #829).
 * `last_response_json()` now works with content-types that end with `+json`, 
 e.g., `application/problem+json` (@cgiachalis, #782).
+* `req_body_form()` now creates a valid empty request body when no parameters
+  are provided (@arcresu, #836).
 
 # httr2 1.2.2