Payload
The actual data in the body of a request or response, as opposed to the URL and headers wrapped around it.
See it
What it is
The payload is the cargo: the body of a request or response, as opposed to the envelope around it (URL, method, headers, status). When docs say 'send this payload', they mean the JSON you put in the body. When a webhook 'delivers a payload', they mean the event object that landed on your endpoint. Same word, both directions.
The format is declared by the Content-Type header, and the two must agree or the server rejects you: application/json for JSON, application/x-www-form-urlencoded for classic form posts, multipart/form-data for file uploads. GET requests conventionally carry no payload at all, which is why filters go in query parameters there. Keep payloads lean: only the fields the receiver needs, gzipped, and paginated rather than 50 MB of rows in one response.
Two traps. First, the raw bytes matter for anything signed. If your framework parses the body before you verify a webhook's HMAC, the signature check fails on formatting alone; capture the raw body first. Second, payloads are user input even when they arrive from a trusted partner: validate against a schema, ignore unknown fields, cap the size, and never log a whole payload that might carry tokens or card details.
Ask AI for it
Define and validate the payloads for this endpoint. Write a schema for the request body (Zod or the project's validator), parse against it at the top of the handler, strip unknown fields, and return 422 with per-field errors on failure. Set and check Content-Type: application/json, cap the body size, and keep the raw body available for signature verification. Give me an example request payload and example success and error response payloads for the docs, with secrets and PII redacted in all logging.