“From a security point of view, if you have a choice, then JSON is the preferred format.”

Transcript evidence from Katy Anton -- OWASP Top 10 #4 XXE.