Overview

application/json is the media type for data serialized as JavaScript Object Notation, and it is the de facto standard for exchanging data between REST APIs and web front ends. It represents key-value objects and arrays as text that is human-readable and parseable in nearly every language.

Details

RFC 8259 requires JSON text to be encoded in UTF-8, UTF-16, or UTF-32, and UTF-8 is the only sensible default for network interchange. For that reason application/json defines no charset parameter; writing `; charset=utf-8` is ignored, and the encoding is detected from a byte order mark or the first characters. If a server emits Korean text or emoji as Latin-1, parsing breaks.

The body consists of objects, arrays, strings, numbers, true, false, and null, and it forbids comments and trailing commas. Numbers are handled as IEEE 754 doubles, so integers beyond 2^53 (Twitter snowflake IDs, int64 values) lose precision; serialize large integers as strings to be safe. In APIs you negotiate with Accept: application/json and echo the same type in the response Content-Type.

Syntax

e.g. Content-Type: application/json; charset=utf-8

File extensions

Notes

• The charset parameter is undefined by the spec, but it is sometimes added to appease old clients. It is harmless yet cannot change the encoding — always emit UTF-8.
• To keep a JSON response from being executed as a <script>, a common Google-style defense prefixes sensitive JSON arrays with `)]}',\n`, guarding against JSON hijacking.
• A top-level JSON array was historically a CSRF risk in some browsers; send `X-Content-Type-Options: nosniff` so the declared Content-Type is not overridden by MIME sniffing.

Related types

Related headers