API › Module 2 › Lesson 3
JSON Contracts and Content-Type
Shapes are agreements — POST/GET JSON only on 127.0.0.1:8811.
Visual · rest_json_contracts
JSON + schema discipline. 127.0.0.1:8811.
Opening
If the keys are wrong, the status can still be 200 — that is how quiet bugs ship.
JSON is the common body language of modern HTTP APIs. A contract says which keys exist, which types they hold, and which are required. Content-Type: application/json is how you declare the language. Defenders care because mass assignment and excess exposure (later modules) hide in extra keys and fat responses. Original Cyberlium. Practice minimal JSON round-trips on 127.0.0.1:8811. You will NOT fuzz stranger APIs with junk JSON, not sqlmap “through JSON,” not phish for tokens. Next: REST Lab — Methods and Bodies.
1. Declare the language, then keep the shape small
Send Content-Type: application/json and a body the lab expects. Prefer explicit keys over “whatever the UI sent.” Small contracts are easier to allowlist later.
Pretty-print in notes for learning; wire format can be compact. Either way, validate on YOUR server — do not assume the client is honest.
Command guide
Try these commands — Declare the language, then keep the shape small
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
JSON Schema — https://json-schema.org/ (contract literacy)
Optional command
jq manual — https://jqlang.github.io/jq/manual/ (parse YOUR lab JSON)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS http://127.0.0.1:8811/items 2>/dev/null | jq '.[0] // .items[0] // .' || curl -sS http://127.0.0.1:8811/items | python3 -m json.tool curl -sS http://127.0.0.1:8811/items 2>/dev/null | jq 'keys' 2>/dev/null || echo 'Validate required fields on YOUR lab response'
Primary tools to practice this lesson: curl, jq. Reference sites: JSON Schema (https://json-schema.org/); jq manual (https://jqlang.github.io/jq/manual/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. 200 with the wrong shape is still a bug
Status literacy is incomplete without body literacy. A 200 that returns HTML when you asked for JSON is a contract break. A 200 that omits a required field is a contract break.
On YOUR lab, intentionally send a bad key and record what happens. That experiment stays on 127.0.0.1:8811.
3. What you will not “contract test”
Public APIs you do not own. Production checkouts. Classmate staging without written scope. Those are other people’s blast radii.
Ship a sample request/response pair in your note file. Quiz will ask whether Content-Type and keys match.
4. What you ship: one valid and one invalid JSON exchange on YOUR lab
Valid POST/GET with application/json. One intentional bad-key trial. DEMO GATE. Dest 127.0.0.1:8811. No stranger fuzzing.
5. What you record before the next lesson
Date. Sample JSON in/out. Bad-key outcome. SAFE 127.0.0.1:8811. File t13-m02-l03-json-contracts.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
Wrong
Fuzz a public API with random keys “for schema discovery.” sqlmap JSON endpoints you Google. Commit live customer payloads.
Right
Two exchanges on loopback. Next: REST Lab — Methods and Bodies.
Mission: prove JSON is a contract, not a blob
1) / STOP if router. 2) Send valid JSON with Content-Type to 127.0.0.1:8811. 3) Send one bad shape and record status/body. Never fuzz unowned APIs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor how to pretty-print JSON locally — not how to scrape stranger OpenAPI for targets.
Knowledge Check
APPLY: curl returns 200 but body is HTML while you sent Accept: application/json. Literacy verdict?
Multiple choice
Knowledge Check
APPLY: True or False: Extra JSON keys are always harmless.
True or False
Knowledge Check
APPLY: Where do you practice bad-key JSON in this module?
Multiple choice