API Payload Debugging Checklist
Use a compact API payload checklist for method, URL, headers, body shape, cURL output, and response review.
Check request shape before sending
Most API payload debugging starts with the method, endpoint, headers, and body type before response errors are reviewed.
- Confirm method and URL path.
- Check content type and authorization header format.
- Validate the JSON body before generating cURL.
Compare request and response together
A 400 or 415 response often points back to body syntax, content type, or required field shape.
- Keep the status code, response message, and sent body together.
- Compare required fields against the endpoint documentation.
- Regenerate the cURL command after every request edit.
Reference Blocks
Use these short blocks as starting notes before opening the calculator.
Request checklist
Method: POST URL: https://api.example.com/items Headers: Content-Type and Authorization Body: valid JSON with required fields After send: status code, error body, retry note
Debug table
Symptom | First check 400 Bad Request | JSON body and required fields 401 Unauthorized | Token format and expiry 415 Unsupported Media Type | Content-Type header 422 Validation Error | Field names and value types
Worked Examples
Content type mismatch
The body is JSON but Content-Type is missing.
Add Content-Type: application/json before retrying.
A 415 response often points to media type mismatch.
Required field missing
The API expects email but the body sends userEmail.
Match the field name required by the endpoint.
A valid JSON body can still fail endpoint validation.
Token format
The request sends a token without the Bearer prefix.
Use the authorization format expected by the API.
Do not expose real secrets in shared cURL examples.
Common Mistakes
- Debugging the response before validating the JSON body.
- Forgetting to update cURL after changing headers or body fields.
- Sharing real access tokens in request examples.
When This Is Not Enough
- Use endpoint documentation for required field names and allowed values.
- Do not use shared examples with real credentials, customer data, or private URLs.
- Check server logs when the request shape is valid but the service still fails.