How to debug an invalid JSON API response

Start with the raw response, not the parser error

A JSON parser error tells you that parsing failed, but it does not tell you why the server returned that body. In your browser network panel, inspect the status code, Content-Type header and response body. A login redirect, proxy error or framework exception can produce HTML where your client expects JSON. Check those before changing the JSON itself. A 200 response also does not prove that the body matches your application schema.

Reproduce a syntax problem with a small input

This object has two independent errors: the name key is not quoted and the final property has a trailing comma. JSON requires double quotes around object keys and does not allow trailing commas. Paste the example into the validator, then fix one problem at a time. Parser messages and reported positions vary by runtime.

{name: "Ada", "active": true,}

Corrected:
{"name": "Ada", "active": true}

Handle HTTP errors before decoding in JavaScript

Read the body once so that it remains available when you report an error. This example checks the HTTP result and then parses JSON. A production client should also decide which response media types it supports and handle empty responses such as 204 explicitly. Do not log full bodies that contain tokens or customer records.

const response = await fetch('/api/profile');
const body = await response.text();
if (!response.ok) {
  throw new Error(`HTTP ${response.status}`);
}
const data = JSON.parse(body);

Valid JSON is different from valid application data

The values null, 42 and an empty array are valid JSON. They can still be wrong for an endpoint that promises a profile object with a numeric id. After parsing, check required fields and types using your application validation or schema library. A formatter changes presentation; it cannot prove that an API contract is correct.

Verify the fix at the source

Correct the endpoint, fixture or serialization step that produced the bad response. Do not remove commas or quotes blindly from production data. Repeat the same request with the same headers and authentication state, verify the HTTP result, and add a regression test for the actual failure. Use a small redacted response when sharing a bug report.