The response looked perfectly reasonable in the logs.

It had the fields I asked for. The values made sense. Nothing looked obviously broken.

Then my application rejected it.

That failure taught me to separate two questions I had been treating as one:

Does the response look correct to a human?