A practical API-debugging guide that combines JSON validation, JWT inspection, Base64 handling, and Unix timestamp checks.
Split the failure into layers
Changing the request body, transport, authentication, and business logic at the same time makes an API failure harder to diagnose. Record the status code, response Content-Type, and raw body first, then change one layer per attempt. A 400 is not always malformed JSON, and a 401 is not always an expired token.
Do not paste production tokens or customer records into tickets. Build a synthetic sample that preserves the structure and still reproduces the failure.
- Separate expected and actual status codes.
- Keep the raw response before formatting it.
- Change one variable in each experiment.
Validate JSON against the contract
Check syntax before meaning. Trailing commas, single quotes, unescaped newlines, and strings in numeric fields are common. Valid JSON can still violate the API contract, so compare required fields, null behavior, date formats, and nested shapes with the schema.
A formatted view makes key and type differences visible. Reduce a large body to the smallest failing sample to learn whether one value or the overall shape causes the error.
Do not mistake decoding for verification
JWT headers and payloads use Base64URL and are not necessarily encrypted. Reading sub, aud, iss, exp, and nbf helps diagnosis, but decoding does not prove the signature. Verify it on a trusted server with the expected key, issuer, audience, and algorithm.
Never accept the token's alg value as the policy. Pin allowed algorithms server-side and test key rotation and clock-skew behavior explicitly.
- Never log a complete bearer token.
- Keep decoding and signature verification distinct.
- Review exp, nbf, aud, and iss together.
Close time and encoding traps
Unix timestamps may be seconds or milliseconds. A thirteen-digit value interpreted as seconds produces a wildly incorrect date; JWT exp values are normally seconds. Compare UTC and local views and measure clock drift between client and server.
Base64URL replaces characters and may omit padding. Once the cause is known, preserve the corrected sample as a regression test so the same bug becomes visible before deployment.
Turn the guide into a safe trial
Test the steps in “A Systematic Workflow for Debugging JSON, JWTs, and APIs” with synthetic data in JSON Formatter & Validator before using live material. Checkmarks remain only in this tab.
Turn the guide into a repeatable review
Use this 4-tool review plan for “A Systematic Workflow for Debugging JSON, JWTs, and APIs”. Goal: A practical API-debugging guide that combines JSON validation, JWT inspection, Base64 handling, and Unix timestamp checks. Start with a safe example instead of real data, then record each expected result and acceptance decision.
JSON Formatter & Validator
- Prepare
- Paste JSON data.
- Apply
- Choose pretty or minified output.
- Acceptance check
- Copy the validated result.
- Expected output
- The result includes formatted JSON, root type, key count, maximum depth, and UTF-8 output bytes. Key count is not the same measurement as array length.. Validate, pretty-print, or minify JSON data.
JWT Decoder
- Prepare
- Paste a non-sensitive test JWT.
- Apply
- Decode its header, payload, and time claims.
- Acceptance check
- Remember that decoding does not verify the signature.
- Expected output
- Header and payload fields become readable. alg declares an algorithm; sub, iss, aud, and exp are claims made by the issuer, not verification results.. Read JWT header and payload as local JSON without verifying the signature.
Base64 Encoder & Decoder
- Prepare
- Enter text.
- Apply
- Choose encode or decode.
- Acceptance check
- Review sensitive output before sharing it.
- Expected output
- Depending on direction, the output is Base64 or decoded Unicode text, with source and output byte measurements.. Encode Unicode text to Base64 or decode it back.
Unix Timestamp Converter
- Prepare
- Enter an epoch value or a calendar date.
- Apply
- Check unit detection and the displayed time zone.
- Acceptance check
- Copy the UTC, local, or Unix result.
- Expected output
- a normalized temporal value, calculation summary, and ambiguous-zone warnings. Convert between epoch seconds, milliseconds, and human-readable dates.
Apply this boundary to JSON Formatter & Validator: JavaScript Number can lose precision for large integers; keep long identifiers as quoted strings. Duplicate keys can be lost during parsing. This tool does not validate a JSON Schema. If that condition is not met, do not pass the output to the next workflow step.
For “A Systematic Workflow for Debugging JSON, JWTs, and APIs”, record the tool, selected setting, browser version, and acceptance or rejection reason for “Inspecting API responses”—not the sensitive content. This keeps the review repeatable without copying real data.
“A Systematic Workflow for Debugging JSON, JWTs, and APIs” was prepared by comparing visible ByteQuant behavior for developer workflows and reproducible product checks. Its limits and acceptance criteria support review; they do not replace legal or security advice.