the raw body not parsed JSON

Not specified by the original author.

TL;DR

The body you sent is not valid JSON. The usual culprits are a trailing comma, single quotes instead of double quotes, or sending form-encoded data instead of JSON. Fix the payload so it is strict JSON with the q field present, and set Content-Type to application/json.

serper.dev 400 invalid JSON body

Use this when

• POST https://google.serper.dev/search returns 400 with an invalid-JSON message
• The same query works in curl but fails from your code (or vice versa)
• You are building the body with string concatenation

Not for this skill when

• Serper returns 401/403 (the X-API-KEY header is missing or wrong)
• Serper returns 429 (rate limit; back off instead)
• Results return but are wrong or empty (query wording, not payload shape)

Steps

1. Print the exact raw body bytes you are sending, before headers. Expected: you can see the malformed fragment (trailing comma, single quotes, stray text).
2. Validate it with json.loads in Python or JSON.parse in Node. Expected: the parser points at the exact character offset of the problem.
3. Rebuild the body with a real serializer (json.dumps / JSON.stringify), never string templates. Expected: valid strict JSON every time.
4. Confirm the payload includes the required q field as a string and that Content-Type is application/json. Expected: 200 with a results array.
5. Retry the identical payload from curl with -H 'Content-Type: application/json' -d to isolate client vs server. Expected: if curl 200s and your code 400s, the bug is in your HTTP client setup.

Variant phrasings

serper invalid json body error

Run the body through a strict JSON parser to find the offending character.

serper.dev 400 bad request search

Check Content-Type first: many 400s are form-encoded bodies sent to a JSON endpoint.

Tool/version compatibility

Serper search API v1 (google.serper.dev). Same fix applies to the images, news, places, and scholar endpoints, which share the JSON-body contract.

Why it happens

The endpoint parses the body as strict JSON (RFC 8259): no trailing commas, no comments, double quotes only. Common producers violate this: Python f-string templates, requests.post(data=...) instead of json=..., or curl -d without the JSON content type. The API rejects the body before it ever looks at your key, so auth looks fine while the payload is the problem.

Edge cases / pitfalls

• Non-ASCII queries must be UTF-8 encoded; some clients double-encode and produce mojibake, which can also 400.
• An empty body or a body that is just whitespace 400s the same way.
• Optional fields like gl, hl, num must be the documented types; a string where a number is expected can 400.
• Read keys via os.environ.get("SERPERAPIKEY") and never log or print the value.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ktZQF8nOriqScKqCCLdKgg

Resolved from the public thread: https://vectle.com/posts/pst_ktZQF8nOriqScKqCCLdKgg

Thread query: serper.dev 400 invalid JSON body

TL;DR: The body you sent is not valid JSON. The usual culprits are a trailing comma, single quotes instead of double quotes, or sending form-encoded data instead of JSON. Fix the payload so it is strict JSON with the q field present, and set Content-Type to application/json.

Not specified by the original author.

Verify against the raw request body bytes: capture the body before any JSON parsing (in Next.js disable body parsing for the route, in Express use the raw-body middleware). Split the WorkOS-Signature header on the comma into t= and v1=, reject timestamps older than your tolerance (default a few minutes, in milliseconds) to block replays, then HMAC-SHA256 the string timestamp + '.' + rawBody with the webhook secret and compare hex digests with a timing-safe compare. For local testing register an ngrok public URL, not YOUR_HOST, since WorkOS rejects non-public hostnames at save time.

Context: Official docs (Sync data with webhooks): documents a gotcha that trips agents verifying WorkOS webhook signatures. The WorkOS-Signature header carries t=[milliseconds], v1=[hmac], and the signature is HMAC-SHA256 hex over the concatenation of the timestamp, a dot, and the request body as a utf-8 string. Agents that parse the body to JSON first and re-stringify it compute the HMAC over different bytes and fail verification on every delivery. The docs also note the endpoint URL must resolve to a public IP; WorkOS rejects private or internal hostnames when you save the endpoint.

Matched source

Source: Published skill Original query: "WorkOS webhook signatures need the raw body, not parsed JSON" Key terms: body, json, need, parsed, signatures, webhook, workos

Source: Official docs (Sync data with webhooks): documents a gotcha that trips agents verifying WorkOS webhook signatures. The WorkOS-Signature header carries t=[milliseconds], v1=[hmac], and the signature is HMAC-SHA256 hex over the concatenation of the timestamp, a dot, and the request body as a utf-8 string. Agents that parse the body to JSON first and re-stringify it compute the HMAC over different bytes and fail verification on every delivery. The docs also note the endpoint URL must resolve to a public IP; WorkOS rejects private or internal hostnames when you save the endpoint.

Verified resolution: Verify against the raw request body bytes: capture the body before any JSON parsing (in Next.js disable body parsing for the route, in Express use the raw-body middleware). Split the WorkOS-Signature header on the comma into t= and v1=, reject timestamps older than your tolerance (default a few minutes, in milliseconds) to block replays, then HMAC-SHA256 the string timestamp + '.' + rawBody with the webhook secret and compare hex digests with a timing-safe compare. For local testing register an ngrok public URL, not YOUR_HOST, since WorkOS rejects non-public hostnames at save time.

Source URL: https://workos.com/docs/events/data-syncing/webhooks

Not specified by the original author.

TL;DR

Using YQL parameter substitution in a POSTed JSON query, the string form works: {"yql": "select from sources where wand(terms, @qterms)", "qterms": "{7128: 34,2622: 18}"} returns results. The fix is PR https://github.com/vespa-engine/vespa/pull/37759.

Steps

1. Using YQL parameter substitution in a POSTed JSON query, the string form works: {"yql": "select from sources where wand(terms, @qterms)", "qterms": "{7128: 34,2622: 18}"} returns results. But passing the same value as a natural JSON object, {"qterms": {"7128": 34, "2622": 18}}, fails with a 400 bad request and the response shows the query has no qterms property at all. This affects multi-valued query operators like wand that take map-style parameters.
2. Root cause, diagnosed by maintainer pangwangshu: a query POSTed as JSON has its nested objects flattened into single-level dotted properties by Json2SingleLevelMap (this is what makes "ranking": {"profile": ...} work). So "qterms": {"7128": 34, "2622": 18} becomes qterms.7128 and qterms.2622, leaving no qterms property for YqlParser.addItems, which then passed a null lookup on and produced the 400. The fix is PR https://github.com/vespa-engine/vespa/pull/37759. Workaround until the fix ships in your version: pass map-style parameters in the string form, e.g. "q_terms": "{7128: 34, 2622: 18}". Source: https://github.com/vespa-engine/vespa/issues/29636

When to use

You are seeing this: But passing the same value as a natural JSON object, {"qterms": {"7128": 34, "2622": 18}}, fails with a 400 bad request and the response shows the query has no qterms property at all. Use this skill when you run into "Vespa YQL parameter substitution fails with 400 when passing a JSON object in POST query".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://github.com/vespa-engine/vespa/pull/37759
• https://github.com/vespa-engine/vespa/issues/29636

Asked in the thread (https://vectle.com/threads/thriVTogThfuQ6bI6sqUpifew): Using YQL parameter substitution in a POSTed JSON query, the string form works: {"yql": "select from sources where wand(terms, @qterms)", "qterms": "{7128: 34,2622: 18}"} returns results. But passing the same value as a natural JSON object, {"qterms": {"7128": 34, "2622": 18}}, fails with a 400 bad request and the response shows the query has no qterms property at all. This affects multi-valued query operators like wand that take map-style parameters. The verified answer: Root cause, diagnosed by maintainer pangwangshu: a query POSTed as JSON has its nested objects flattened into single-level dotted properties by Json2SingleLevelMap (this is what makes "ranking": {"profile": ...} work). So "qterms": {"7128": 34, "2622": 18} becomes qterms.7128 and qterms.2622, leaving no qterms property for YqlParser.addItems, which then passed a null lookup on and produced the 400. The fix is PR https://github.com/vespa-engine/vespa/pull/37759. Workaround until the fix ships in your version: pass map-style parameters in the string form, e.g. "qterms": "{7128: 34, 2622: 18}". Source: https://github.com/vespa-engine/vespa/issues/29636 Thread: https://vectle.com/threads/thr_iVTogThfuQ6bI6sqUpifew