Check the MIME type used by the API
Search by extension or media type and check registration status, related extensions, and Content-Type examples.
Open MIME type list and extension searchConclusion: Compare the API specification, Content-Type, and Body
If the API requires application/json, verify not only the request header but also that the body is valid JSON.
HTTP 415 is not necessarily caused only by Content-Type; Content-Encoding and Resource-specific Policies are also candidates.
Example of sending JSON as text/plain
POST /api/items HTTP/1.1
Content-Type: text/plain
{"name":"sample"}If the Server accepts only application/json, it rejects the request as a format mismatch.
Diagnosing 415
Place the API documentation next to the actual request.
| Account to check | Confirmation details | judgment |
|---|---|---|
| API specifications | Allow Media Type | Such as application/json |
| Header | Content-Type/Encoding | Matches the body |
| Body | JSON/multipart/binary | Readable by the Parser |
Fix the Request.
- Check the allowed media types in the API documentation.
- Check actual headers with the Network Log or curl.
- Correct the body to a supported format.
- Resend including transformations by Proxy and Gateway.
Separate extension, media type, actual data, and Content-Type
| information | example | What you can check |
|---|---|---|
| File Name | report.pdf | The name assigned by the user or application |
| Extension | Suffix in the name. Does not guarantee contents. | |
| Media Type | application/pdf | A registered or operational identifier that represents a data format |
| Actual Content | Such as %PDF-... | Formats that can be handled by actual byte sequences or parsers |
| HTTP Content-Type | application/pdf | The value the sender reports as the representation format of an HTTP message |
An extension can suggest a general MIME type, but cannot determine whether the file contents are actually that format, whether they are safe, or whether the upload destination permits them.
Steps for checking the MIME type and correcting the setting
- Record the file name, extension, and Content-Type of the request or response where the problem occurs.
- Enter an extension or media type in the MIME list, then check candidates and registration status.
- Compare API documentation, IANA registrations, and format specifications.
- Correct the applicable setting among Content-Type, Accept, Content-Disposition, and the upload allowlist.
- Recheck with the Network Panel, curl, the actual API, and the actual browser.
Do not trust MIME type alone for file uploads
Content-Type and File.type during Upload are supplied by the Client and can be spoofed or misclassified. Follow OWASP Defense in Depth and combine multiple validations as appropriate for the use case.
- Limit allowed extensions with an allowlist, and also check double extensions and normalized names.
- Validate Content-Type as supplementary information; do not make it the sole allow condition.
- Check file signatures, whether decoding is possible with a parser, and actual content as needed.
- Design file size, saved name, save location, permissions, and Content-Disposition when publishing.
- For required business operations, also perform malware checks and sandbox processing separately.
The HTML accept attribute is a hint that narrows file picker candidates; it is not a replacement for server-side security validation.
What you can check with the current MIME type list and extension search
| Function | Current support | Boundaries and precautions |
|---|---|---|
| search | Partially match .png, png, image/png, purpose, and aliases without case sensitivity. | Do not determine file binary content or perform regular-expression searches |
| Category | application, audio, font, image, message, model, multipart, text, video | Does not comprehensively include every IANA Registry entry |
| Status | IANA-registered, compatible / legacy, non-standard, and deprecated | Check the Vendor Tree using Media Type names and IANA references |
| Reverse lookup | Multiple candidates for one extension, and multiple extensions for one MIME type | Do not assume extensions and MIME types have a one-to-one relationship |
| Copy | MIME type, extension, details, and HTTP header example | Do not send copied values to a server |
| Local file comparison | Compare file names, extensions, and browser-provided File.type with the built-in dictionary | Do not inspect file contents, signatures, or malware |
| Generate headers | Content-Type, charset, Content-Disposition, nosniff | Do not send to the real server configuration or API |
The Tool is a list for checking Media Types. It is not a Security Scanner that determines whether a File is safe.
Related tools and primary sources
- Check 415 in the HTTP status code list
- Check Content-Type with HTTP header analysis
- Check response structure with JSON Tree Viewer
- Check JSON syntax with JSON Formatter
- Check delimiters and character encoding with the CSV / TSV Viewer
- Convert image formats with the image conversion tool
- Convert audio formats with the audio conversion tool
- Use Base64 Encoder / Decoder to check a data URL.
- IANA Media Types Registry
- RFC 6838: Media Type Specifications and Registration Procedures
- RFC 9110: HTTP Semantics
- MDN: Common media types
- MDN: Content-Type
- MDN: Accept
- MDN: X-Content-Type-Options
- WHATWG HTML: File Upload state
- OWASP File Upload Cheat Sheet
Use IANA as the authority for official media types and registration status, RFC 9110 for HTTP semantics, and primary sources such as OWASP plus official documentation for the framework in use for upload security.
Recheck the JSON POST
Search for application/json in the MIME list and set it in the request header.
After the fix, recheck not only the header name but also the actual body and file format, as well as the acceptance conditions of the application that uses it.
- Check the API specification
- Retrieve actual Headers
- Check JSON syntax
- Resend and check status
Remove sensitive headers such as Authorization before sharing.
Frequently asked questions
- Can the file format be determined if the extension is known?
- It cannot be determined conclusively. An extension is an entry point for finding common candidates; check the File Signature, Parser, and actual Content as needed.
- Is application/octet-stream an error?
- It is not necessarily an error. It may be intentionally used as generic Binary, or a specific Content-Type may not have been set when it was stored.
- Can this tool determine the safety of uploaded files?
- No. This is not a Security Scanner that reads File contents; it is a Tool that compares the extension and Browser-provided MIME information with a built-in dictionary.