JSON vs URL Encoded API Calls - JSON returns BAD CSRF

Forms send inputs as Strings, but shouldn’t “category” be an Int?