JSON vs YAML vs XML: formats and pitfalls

Which format, in one rule

JSON is the default format of REST APIs; YAML is what people write by hand for configuration (Ansible playbooks, Kubernetes manifests, pipeline files); XML is the older, more verbose format that survives in NETCONF, SAML and SOAP. They all describe the same kinds of structure, nested key-value data and lists, so exam questions test whether you can read one, convert it to another, and spot what breaks it. The rule: machines talking to machines use JSON, humans editing files use YAML, and protocols standardised before about 2010 use XML.

The same data three times

One VLAN with two ports:

{
  "vlan": {
    "id": 10,
    "name": "Sales",
    "active": true,
    "ports": ["Gi1/0/1", "Gi1/0/2"]
  }
}

vlan:
  id: 10
  name: Sales
  active: true
  ports:
    - Gi1/0/1
    - Gi1/0/2

<vlan id="10">
  <name>Sales</name>
  <active>true</active>
  <ports>
    <port>Gi1/0/1</port>
    <port>Gi1/0/2</port>
  </ports>
</vlan>

Read the shapes first. JSON uses braces for objects, brackets for arrays, and double-quoted keys. YAML replaces all of that with indentation and a dash for each list item. XML uses a tag pair for every value, can carry data as an attribute (id="10") or as a child element, and has exactly one root element. XML has no native list: repetition of <port> is the list.

What Python makes of each

JSON true, false and null become True, False and None. The XML row is the surprising one: root.attrib["id"] is the string "10", not an integer, because XML itself carries no types. Types come from a schema (or a YANG model) or from your own conversion. The structure in the first example is read as data["vlan"]["ports"][0], which is "Gi1/0/1".

Pitfalls that cause real failures

JSON is strict. RFC 8259 allows only double-quoted strings, no comments and no trailing commas, and it does not permit NaN or Infinity as numbers. A stray comma after the last item is the classic invalid-JSON question. (Python’s json module is lenient about NaN by default, which is a library choice, not the standard.)

YAML indentation is syntax. The YAML specification says tab characters must not be used for indentation, so a tab in a playbook is an error, and so is inconsistent spacing. A list item at the wrong depth silently changes the structure rather than failing.

YAML guesses types. Under the YAML 1.2 core schema only true and false (in a few spellings) are booleans. Older YAML 1.1 rules, which PyYAML still follows, also treat yes, no, on and off as booleans. Running PyYAML 6.0.3 on this input shows the problem:

$ python3 -c "import yaml; print(yaml.safe_load('a: no\nb: 3.10\nd: 0777'))"
{'a': False, 'b': 3.1, 'd': 511}

The value no (for example the country code for Norway, in any case: NO behaves the same) becomes False, the version 3.10 becomes the float 3.1, and 0777 is read as octal 511. The fix is quoting: "no", "3.10", "0777". Also use safe_load, never plain load, on untrusted input, because the unsafe loader can construct arbitrary Python objects.

XML escapes and namespaces. A literal < or & in text must be written < or &. Elements can belong to a namespace (xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"), and a parser searching for the plain tag name will not find a namespaced element. This is exactly what NETCONF replies look like.

Where each one shows up

YAML 1.2 was designed so that valid JSON is also valid YAML, so a JSON file can be fed to a YAML tool. The reverse is false: YAML comments, anchors and indentation have no JSON equivalent.

Which exams test this

How questions are built around it

Most questions give a snippet and ask one of three things: which format is this, what is wrong with it, or what Python call or type results. The deciding details are small. { and [ mean JSON; indentation and - mean YAML; angle brackets mean XML. “Cannot be parsed” in a JSON snippet is nearly always a trailing comma, single quotes or a comment. “Human readable configuration file” points to YAML; “data exchanged between a client and a REST API” points to JSON; “namespace” or “attribute” points to XML. For Python, loads takes a string and load takes a file object, and safe_load is the safe YAML call to recognise.

Practice questions

Go deeper

• RFC 8259, The JSON Data Interchange Format
• YAML 1.2.2 specification
• W3C Extensible Markup Language (XML) 1.0
• Next on this site: REST API basics, Python for network engineers and the 200-901 cheat sheet.