Question

A SOC analyst writes a Python script to consume a threat intelligence REST API. The script sends a GET request and receives a response with status code 200. When the script tries to call response.json() to parse the body, it raises a JSONDecodeError even though the request succeeded. Inspecting the raw response, the analyst sees the following header: Content-Type: application/xml. Which conclusion best explains the failure?

Accepted Answer

The server returned the payload in XML format, so the analyst must parse it with an XML parser rather than calling response.json().

Answer

The 200 status code is incorrect and the server actually returned an authentication error that corrupted the body.

Answer

The Content-Length header is missing, so the body was truncated and cannot be parsed as JSON.

Answer

The API rate limit was exceeded, and the Retry-After header caused the JSON body to be malformed.