A practical API-debugging guide that combines JSON validation, JWT inspection, Base64 handling, and Unix timestamp checks.
Turn the guide into a safe trial
Complete the steps with a synthetic example before using real data. Checkmarks live only in this tab.
Split the failure into layers
Changing the request body, transport, authentication, and business logic at the same time makes an API failure harder to diagnose. Record the status code, response Content-Type, and raw body first, then change one layer per attempt. A 400 is not always malformed JSON, and a 401 is not always an expired token.
Do not paste production tokens or customer records into tickets. Build a synthetic sample that preserves the structure and still reproduces the failure.
- Separate expected and actual status codes.
- Keep the raw response before formatting it.
- Change one variable in each experiment.
Validate JSON against the contract
Check syntax before meaning. Trailing commas, single quotes, unescaped newlines, and strings in numeric fields are common. Valid JSON can still violate the API contract, so compare required fields, null behavior, date formats, and nested shapes with the schema.
A formatted view makes key and type differences visible. Reduce a large body to the smallest failing sample to learn whether one value or the overall shape causes the error.
Do not mistake decoding for verification
JWT headers and payloads use Base64URL and are not necessarily encrypted. Reading sub, aud, iss, exp, and nbf helps diagnosis, but decoding does not prove the signature. Verify it on a trusted server with the expected key, issuer, audience, and algorithm.
Never accept the token's alg value as the policy. Pin allowed algorithms server-side and test key rotation and clock-skew behavior explicitly.
- Never log a complete bearer token.
- Keep decoding and signature verification distinct.
- Review exp, nbf, aud, and iss together.
Close time and encoding traps
Unix timestamps may be seconds or milliseconds. A thirteen-digit value interpreted as seconds produces a wildly incorrect date; JWT exp values are normally seconds. Compare UTC and local views and measure clock drift between client and server.
Base64URL replaces characters and may omit padding. Once the cause is known, preserve the corrected sample as a regression test so the same bug becomes visible before deployment.
Turn the guide into a repeatable review
Use this 4-tool review plan for “A Systematic Workflow for Debugging JSON, JWTs, and APIs”. Goal: A practical API-debugging guide that combines JSON validation, JWT inspection, Base64 handling, and Unix timestamp checks. Start with a safe example instead of real data, then record each expected result and acceptance decision.
JSON Formatter & Validator
- Prepare
- Paste JSON data. Expected format for JSON Formatter & Validator: For JSON Formatter & Validator, provide syntactically valid JSON containing the object, array, or fields named by the tool. The requested outcome is to validate, pretty-print, or minify JSON data..
- Apply
- Choose pretty or minified output. JSON Formatter & Validator applies this method: JSON Formatter & Validator uses this disclosed method to validate, pretty-print, or minify JSON data: parsing uses deterministic rules that preserve field and type boundaries.
- Acceptance check
- Copy the validated result. Acceptance check for JSON Formatter & Validator: Before accepting a JSON Formatter & Validator result, complete field names, value types, escaping, and empty or null values compared with the source; the evidence should support the goal to validate, pretty-print, or minify JSON data..
- Expected output
- When JSON Formatter & Validator finishes, it returns a parsed structure, field metrics, and explicit syntax findings, organised around the goal to validate, pretty-print, or minify JSON data.. Validate, pretty-print, or minify JSON data.
JWT Decoder
- Prepare
- Paste a non-sensitive test JWT. Expected format for JWT Decoder: For JWT Decoder, provide synthetic or minimized code, configuration, identifiers, or file content you are authorized to review. The requested outcome is to read JWT header and payload as local JSON without verifying the signature..
- Apply
- Decode its header, payload, and time claims. JWT Decoder applies this method: JWT Decoder uses this disclosed method to read JWT header and payload as local JSON without verifying the signature: content is not executed; only explainable static patterns and bounded browser operations are applied.
- Acceptance check
- Remember that decoding does not verify the signature. Acceptance check for JWT Decoder: Before accepting a JWT Decoder result, complete manual review at the source location and independent verification with an appropriate professional security tool or authorized process; the evidence should support the goal to read JWT header and payload as local JSON without verifying the signature..
- Expected output
- When JWT Decoder finishes, it returns evidence locations, severity, false-positive considerations, and the next verification action, organised around the goal to read JWT header and payload as local JSON without verifying the signature.. Read JWT header and payload as local JSON without verifying the signature.
Base64 Encoder & Decoder
- Prepare
- Enter text. Expected format for Base64 Encoder & Decoder: For Base64 Encoder & Decoder, provide fields or lines that follow the tool labels and contain no unnecessary personal data. The requested outcome is to encode Unicode text to Base64 or decode it back..
- Apply
- Choose encode or decode. Base64 Encoder & Decoder applies this method: Base64 Encoder & Decoder uses this disclosed method to encode Unicode text to Base64 or decode it back: input is structured with disclosed rules and is not sent to an external system without user action.
- Acceptance check
- Review sensitive output before sharing it. Acceptance check for Base64 Encoder & Decoder: Before accepting a Base64 Encoder & Decoder result, complete manual review of required fields, dates and numbers, audience fit, and any official requirements; the evidence should support the goal to encode Unicode text to Base64 or decode it back..
- Expected output
- When Base64 Encoder & Decoder finishes, it returns an editable draft, field summary, and explicit next action, organised around the goal to encode Unicode text to Base64 or decode it back.. Encode Unicode text to Base64 or decode it back.
Unix Timestamp Converter
- Prepare
- Enter an epoch value or a calendar date. Expected format for Unix Timestamp Converter: For Unix Timestamp Converter, provide a date, time, duration, or schedule with an explicit format and time zone. The requested outcome is to convert between epoch seconds, milliseconds, and human-readable dates..
- Apply
- Check unit detection and the displayed time zone. Unix Timestamp Converter applies this method: Unix Timestamp Converter uses this disclosed method to convert between epoch seconds, milliseconds, and human-readable dates: calendar, time-zone, and inclusion rules are calculated separately.
- Acceptance check
- Copy the UTC, local, or Unix result. Acceptance check for Unix Timestamp Converter: Before accepting a Unix Timestamp Converter result, complete uTC equivalence, daylight-saving transitions, boundary dates, and applicable official calendar rules; the evidence should support the goal to convert between epoch seconds, milliseconds, and human-readable dates..
- Expected output
- When Unix Timestamp Converter finishes, it returns a normalized temporal value, calculation summary, and ambiguous-zone warnings, organised around the goal to convert between epoch seconds, milliseconds, and human-readable dates.. Convert between epoch seconds, milliseconds, and human-readable dates.
Apply this boundary to JSON Formatter & Validator: JSON Formatter & Validator limitation: Verify schema, encoding, and data-loss assumptions in the target system. If that condition is not met, do not pass the output to the next workflow step.
For “A Systematic Workflow for Debugging JSON, JWTs, and APIs”, record the tool, selected setting, browser version, and acceptance or rejection reason for “Inspecting API responses: local analysis with JSON Formatter & Validator”—not the sensitive content. This keeps the review repeatable without copying real data.
Content is checked against visible ByteQuant product behavior and the listed primary sources where available. It is general information, not legal or security advice.