By definition, any problems sent to a JSON endpoint necessarily needs to be caught at runtime. You can build up all sorts of defences up to the point of the ser

By definition, any problems sent to a JSON endpoint necessarily needs to be caught at runtime. You can build up all sorts of defences up to the point of the service boundary, but at some point, something is going to be accepting messages from unknown or little-known services expressed as JSON documents and not a statically-typed interface. That's a pretty fundamental difference in my mind.