diff --git a/app/Controllers/Api/NonEbClaimApiController.php b/app/Controllers/Api/NonEbClaimApiController.php
index 5a9fb8ef..7691df0f 100644
--- a/app/Controllers/Api/NonEbClaimApiController.php
+++ b/app/Controllers/Api/NonEbClaimApiController.php
@@ -206,7 +206,11 @@ class NonEbClaimApiController extends BaseController
             return $this->respond(['status' => false, 'code' => 401, 'message' => 'Unauthorized'], 401);
         }
 
-        $body = $this->request->getJSON(true) ?? $this->request->getPost();
+        $rawBody = $this->request->getBody();
+        $isJson  = str_contains($this->request->getHeaderLine('Content-Type'), 'application/json');
+        $body    = ($isJson || ($rawBody !== '' && $rawBody !== null))
+            ? (json_decode($rawBody, true) ?? $this->request->getPost())
+            : $this->request->getPost();
 
         // Validate minimal user-facing fields only
         $rules = [
@@ -363,7 +367,11 @@ class NonEbClaimApiController extends BaseController
             return $this->respond(['status' => false, 'code' => 401, 'message' => 'Unauthorized'], 401);
         }
 
-        $body     = $this->request->getJSON(true) ?? [];
+        try {
+            $body = $this->request->getJSON(true) ?? [];
+        } catch (\Throwable $e) {
+            return $this->respond(['status' => false, 'code' => 400, 'message' => 'Invalid JSON body'], 400);
+        }
         $page     = max(1, (int)($body['page']     ?? 1));
         $per_page = min(100, max(1, (int)($body['per_page'] ?? 20)));
         $offset   = ($page - 1) * $per_page;
@@ -544,7 +552,11 @@ class NonEbClaimApiController extends BaseController
             return $this->respond(['status' => false, 'code' => 401, 'message' => 'Unauthorized'], 401);
         }
 
-        $body             = $this->request->getJSON(true) ?? $this->request->getPost();
+        try {
+            $body = $this->request->getJSON(true) ?? $this->request->getPost();
+        } catch (\Throwable $e) {
+            return $this->respond(['status' => false, 'code' => 400, 'message' => 'Invalid JSON body'], 400);
+        }
         $client_id_md5    = trim($body['client_id']       ?? '');
         $client_branch_id = (int)($body['client_branch_id'] ?? 0);