Decoding API response of unknown encoding?

Question

I'm using Proxyman to inspect the api requests of an app I use. Most of the data is returned in plain JSON blobs but there is one response which is returning data encoded/encrypted. How can I go about determining the format/encoding of the data?

I'm interested more generally in how I could go about figuring this out on my own in the future because I've had other instances in the past where I gave up decoding apis due to unknown data formatting/encoding, but I'll post the specific data I'm trying to decode in case it's some sort of standard format that someone might quickly recognize.

The only structure I see is that the response is always a json object with indexes "z" and "k", my best guess is that z is some data and perhaps k is a key used to decrypt it? I haven't been able to find anything on google about json objects with z/k keys.

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: application/json; charset=utf-8
Date: Wed, 02 Feb 2022 16:43:32 GMT
Server: Google Frontend
Content-Length: 2143

{ "z": "WNuGTity5EwfHPkeR6vWHzscXr953/mBqvVxKYi99okV/jL64xQUmGcstfMPIkcCHcAHNYlwQ0GiQBc5pCjb3GSe6TrBQ2K0OF3Xl/PXetkgUep3luZl8PFvNUYzPpwBWdiLgRQyKOKnr4yweZLbVcNUE8rXQ4CqWek1RB53xVDxU5YNYgTk1Cl5JDsdOdIwEg9VII5rp/GZhD/2IGK1fMmcHNXT4mIAQ6eNKqcCeTVJP1aUFoFdMYbyhY9gMH4uFOqorUSMYhrcu+bMKq7td1r6cHn+WnM+XBlkIRrQ04qmzezhISbr0n+XKImYuRFUOxxev3nf+YGq9XEpiL32iRX+MvrjFBSYZyy18w8iRwKTUckp2izEk6JAFzmkKNvcNXVCgfGGmPIh79UpZNUFQyBR6neW5mXw8W81RjM+nAFZ2IuBFDIo4qevjLB5kttVw1QTytdDgKpZ6TVEHnfFUPFTlg1iBOTUKXkkOx050jASD1Ugjmun8ZmEP/YgYrV8yZwc1dPiYgBDp40qpwJ5NUk/VpQWgV0xhvKFj2Awfi4U6qitRIxiGqMVDyDoR1htWvpwef5acz7fK4c+gv5EP6bN7OEhJuvSf5coiZi5EVQ7HF6/ed/5gbekTVDREpcTvQ/srh2vbIDJOB3wA55/Ir7djvsiZ/TFmTlSzGyIsfMV3vnJtYQWgYObGRX2nuPIsdZpunTfPGjxbzVGMz6cAV0SLgkwrXqYp6+MsHmS21VwsWylC4AF48KehBzrkh9AX2sPfYiJK2gXyB08hSiDzhcPB2lBSYdncqrPY1jPcdU0YDLcj03IG+S4t0/J8iF5yfwRsEEyfOvlalkndFLW6UzVS5suLd+nnpY7Z5n5pewOfBaV0DXwLoKEzOWF6huof71ELVVAgAKnVMpjvRu+pQBmW1Q8GkVAbX1DieqZc5k9u+NNOl0dDV4sUuymxnjllZ73I4b6mfdKb1dBQoUO22IW+RQ4QB+hE2SvqZdBxrgkFV092c4bJu1kniRWupdtMZLzaPsMZdDw23TKM5kPCNLDyS7IlBaG58GhxTYyLrCvRLiS8vPQR+IR+Xv4NgAV+P8RjxVxxug1wgIDJcaDWHY2A1vNHwZet4/YdgQK0/G5y5CZpnrad3bt8yVIkn1L9H+ev7ahAvhuYXk8laQCh+rXu14VXZ9y8UZiAtXypKVjdNe1szqPU3foJwajQN6gps3s4SEm69IPWQ+EFa6nuBfnE+h7MSaSwBtmPFGqGaA34JhNrjhD5ybw0A1qDS65yPIfOMmo0n26XZUJgMdysFxbHT2dZgYXLuvYokt334q9D+yuHa9sgKiunDrvMF9lHAw7XhTBepwVaalvuyw1VbryndI5vOZ8W+r1Ee/+RaTD+KMzLCC35BkuXEUW4QInIv5LlMgH9oddMFu8P+zxlxql6SgxMFhh4J21Zh4k1XNnDY29nfUDbbryOdHeKLlCUlCC1q6tL8RxbQaUyrEYwUfrZ0GLODdK2E3AyRugj7XYwEXX2h/cNlk/7iTKpIrvLi+2xtqZ9UuXboGjQNaEJaYoZaBvKrrLN4oZ21tUYBSTKsJWHm0imzAomCRG87RtcjA5zFb3GmL6wY9yUZ0eCoaKD9gPHidJk8z8Kc4qUEzw23TKM5kPCMjV53iknjoQ58GhxTYyLrAEUipTCXcxLhfIHTyFKIPOFw8HaUFJh2dyqs9jWM9x1TRgMtyPTcgb5Li3T8nyIXnJ/BGwQTJ86+VqWSd0UtbpA1rN8VRLVweeljtnmfml7PBUru3shHUMgoTM5YXqG6jIiGsYx6sLAKdUymO9G76lAGZbVDwaRUBtfUOJ6plzmTGlWcbE7uRg7/ifpd8qcUJKF8VnkCPU1uA6P4I9VPEDQMeclLmd+vnkZIsdTkAL+gUKKtcfVk9XjFK7ZMMFF3aLiL0SkH6CxMmaH8XRnpjqvQ/srh2vbIA4w9gE74wFe/FTlg1iBOTUKXkkOx050jASD1Ugjmun8ZmEP/YgYrV8yZwc1dPiYgBDp40qpwJ5NUk/VpQWgV0x3d+5hnGMdWgU6qitRIxiGlXw5W2Fp7FwWvpwef5acz6NxGBujXFmLtE+l715kY+t",
  "k": "1bKqsULUyOQ" }

Answer 1

Your best bet will probably be to debug the application that sends this API request. It looks like base64, so you could also decode it. I did that and the result was not a proper string, so this is probably binary data. You could store it in a file and run file analysis on it too but I think debugging the app will be most likely the way to succeed.