JSON MIME Type

What does application/json mean?

The application/json media type identifies data written in JavaScript Object Notation, or JSON. Despite the name, JSON is language-independent. It represents values using objects, arrays, strings, numbers, true, false, and null.¹

The registered extension is .json. There is no magic number, so a file cannot be identified reliably from a fixed opening byte sequence. Valid JSON may begin with an object or array, but it may also be a string, number, Boolean, or null after optional whitespace.¹

How JSON became an Internet standard

JSON was first presented at JSON.org in 2001. Douglas Crockford developed and promoted the notation as a small data format based on JavaScript object-literal syntax.² It kept the familiar braces and brackets while defining a portable interchange format independent of JavaScript.

RFC 4627 formally described JSON and registered application/json in 2006. RFC 7159 replaced it in 2014, and the current Internet Standard, RFC 8259, followed in 2017.¹ Ecma published the first edition of ECMA-404 in 2013 and a second edition in 2017. The IETF and Ecma specifications intentionally use the same JSON grammar, although RFC 8259 adds interoperability guidance.¹³

What counts as valid JSON?

JSON's grammar is deliberately small:

• Object member names and string values use double quotes.
• Arrays and objects may be nested.
• Whitespace is allowed around structural characters.
• Comments, trailing commas, NaN, and Infinity are not part of the grammar.
• Any JSON value may appear at the top level, not only an object or array.¹

For example, this is valid JSON:

{
  "project": "Atlas",
  "active": true,
  "retries": 3,
  "tags": ["search", "docs"]
}

This JavaScript-style object literal is not valid JSON:

{
  project: 'Atlas', // JSON requires quoted names and has no comments
}

Modern browsers can parse JSON with JSON.parse() and response bodies with Response.json(). Both APIs are widely available across current browsers.⁴⁵ Opening a .json URL directly usually shows text or a built-in JSON viewer, but presentation varies by browser. A web application should fetch and parse the response instead of depending on that display.

How to identify and open a .json file

Use the declared Content-Type: application/json for an HTTP response and the .json extension for a local file. Because JSON has no signature, content sniffing can only test whether the bytes are valid text and whether that text parses as JSON. A leading { or [ is a useful clue, not proof.

Most code editors recognize .json and provide syntax highlighting, formatting, and error markers. Command-line tools such as jq can query or transform a JSON document. In JavaScript, use JSON.parse() rather than evaluating the text as code.

Support in Poly

Poly treats application/json as a text format throughout its ingestion and reading paths. It extracts a short snippet and line count, then sends the first 1 MiB through full-text indexing and semantic embedding. This makes keys and values searchable by exact wording or related meaning.

JSON files open in Poly's read-only code editor. The viewer detects JSON from the filename and provides syntax highlighting, word wrap, selection, and find-in-file results. It does not validate the document against JSON Schema or display a collapsible object tree.

The Poly agent and MCP file readers can read JSON content as text. The agent's model-input path rejects text files larger than 10 MiB, and search indexing covers only the first 1 MiB. For a very large export, split it into smaller files or query it with a dedicated data tool.

Interoperability and security pitfalls

Valid JSON does not always produce the same result in every program:

• Duplicate object names: RFC 8259 says names should be unique. With duplicates, parsers may keep the last value, reject the object, or expose every pair.¹
• Large numbers: JSON does not set a numeric precision limit, but many systems use IEEE 754 double precision. Integers from -(2^53)+1 through (2^53)-1 are the reliably interoperable range. Encode larger identifiers as strings when exact digits matter.¹⁶
• Object order: Object members are conceptually unordered. Do not attach meaning to their order unless a separate protocol explicitly does so.¹
• Untrusted input: Never parse JSON with eval() or an equivalent code-execution function. RFC 8259 calls this an unacceptable security risk because hostile input could contain executable code.¹
• Resource use: Put limits on document size, nesting depth, string length, and collection size before accepting untrusted JSON.

JSON, I-JSON, and CBOR

I-JSON is still JSON, not a separate file syntax. RFC 7493 narrows the choices that commonly cause inconsistent results.⁶ CBOR is a different binary serialization standardized by RFC 8949. It can represent every JSON data type, but a JSON text parser cannot open CBOR bytes directly.⁷

Conversion between JSON and CBOR is straightforward only while the data stays inside JSON's type system. CBOR byte strings, tags, or non-string map keys need an application-defined mapping when converted to JSON.⁷