python POST request giving ‘the payload is invalid’ message

Here is my code Why is it giving this error even though my payload is correct. Before this, i was not including ‘xsrf-token’ and it was giving ‘Page Expired’ as the response.

import requests
from requests import Session
session = Session()
data = {"type":"Advanced","eingabe":'null',"filters":{"classifications":["Gymnasium - SEK I -"],"lschb":[],"towns":[],"countys":[],"regions":[],"features":[],"bbs_classifications":[],"bbs_occupations":[],"bbs_orientations":[],"plz":0,"oeffentlich":"on","privat":"on"}}  

r = session.get('https://schulen.nibis.de/school/search')
xsrf=r.cookies['XSRF-TOKEN']
HEADERS = {'user-agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36',
            'x-xsrf-token':xsrf,
            'x-requested-with': 'XMLHttpRequest',
            'content-type': 'application/json;charset=UTF-8',
            'x-inertia': 'true',
            'x-inertia-version': '207fd484b7c2ceeff7800b8c8a11b3b6',
            'accept-encoding': 'gzip, deflate, br',
            'accept-language': 'en-US,en;q=0.9,hi-IN;q=0.8,hi;q=0.7,ur-IN;q=0.6,ur;q=0.5,ko-KR;q=0.4,ko;q=0.3'}
res = session.post('https://schulen.nibis.de/school/search',json=data,headers = HEADERS)
print(res.json())

The response I am receiving.

{'message': 'The payload is invalid.', 'exception': 'Illuminate\Contracts\Encryption\DecryptException', 'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php', 'line': 195, 'trace': [{'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Encryption/Encrypter.php', 'line': 136, 'function': 'getJsonPayload', 'class': 'Illuminate\Encryption\Encrypter', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php', 'line': 155, 'function': 'decrypt', 'class': 'Illuminate\Encryption\Encrypter', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php', 'line': 137, 'function': 'getTokenFromRequest', 'class': 'Illuminate\Foundation\Http\Middleware\VerifyCsrfToken', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php', 'line': 75, 'function': 'tokensMatch', 'class': 'Illuminate\Foundation\Http\Middleware\VerifyCsrfToken', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 167, 'function': 'handle', 'class': 'Illuminate\Foundation\Http\Middleware\VerifyCsrfToken', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php', 'line': 49, 'function': 'Illuminate\Pipeline\{closure}', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 167, 'function': 'handle', 'class': 'Illuminate\View\Middleware\ShareErrorsFromSession', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Session/Middleware/AuthenticateSession.php', 'line': 39, 'function': 'Illuminate\Pipeline\{closure}', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 167, 'function': 'handle', 'class': 'Illuminate\Session\Middleware\AuthenticateSession', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php', 'line': 121, 'function': 'Illuminate\Pipeline\{closure}', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php', 'line': 63, 'function': 'handleStatefulRequest', 'class': 'Illuminate\Session\Middleware\StartSession', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 167, 'function': 'handle', 'class': 'Illuminate\Session\Middleware\StartSession', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php', 'line': 37, 'function': 'Illuminate\Pipeline\{closure}', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 167, 'function': 'handle', 'class': 'Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php', 'line': 67, 'function': 'Illuminate\Pipeline\{closure}', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 167, 'function': 'handle', 'class': 'Illuminate\Cookie\Middleware\EncryptCookies', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 103, 'function': 'Illuminate\Pipeline\{closure}', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Routing/Router.php', 'line': 693, 'function': 'then', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Routing/Router.php', 'line': 668, 'function': 'runRouteWithinStack', 'class': 'Illuminate\Routing\Router', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Routing/Router.php', 'line': 634, 'function': 'runRoute', 'class': 'Illuminate\Routing\Router', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Routing/Router.php', 'line': 623, 'function': 'dispatchToRoute', 'class': 'Illuminate\Routing\Router', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php', 'line': 166, 'function': 'dispatch', 'class': 'Illuminate\Routing\Router', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 128, 'function': 'Illuminate\Foundation\Http\{closure}', 'class': 'Illuminate\Foundation\Http\Kernel', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php', 'line': 21, 'function': 'Illuminate\Pipeline\{closure}', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 167, 'function': 'handle', 'class': 'Illuminate\Foundation\Http\Middleware\TransformsRequest', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php', 'line': 21, 'function': 'Illuminate\Pipeline\{closure}', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 167, 'function': 'handle', 'class': 'Illuminate\Foundation\Http\Middleware\TransformsRequest', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php', 'line': 27, 'function': 'Illuminate\Pipeline\{closure}', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 167, 'function': 'handle', 'class': 'Illuminate\Foundation\Http\Middleware\ValidatePostSize', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php', 'line': 87, 'function': 'Illuminate\Pipeline\{closure}', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 167, 'function': 'handle', 'class': 'Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/fruitcake/laravel-cors/src/HandleCors.php', 'line': 37, 'function': 'Illuminate\Pipeline\{closure}', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 167, 'function': 'handle', 'class': 'Fruitcake\Cors\HandleCors', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/fideloper/proxy/src/TrustProxies.php', 'line': 57, 'function': 'Illuminate\Pipeline\{closure}', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 167, 'function': 'handle', 'class': 'Fideloper\Proxy\TrustProxies', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php', 'line': 103, 'function': 'Illuminate\Pipeline\{closure}', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php', 'line': 141, 'function': 'then', 'class': 'Illuminate\Pipeline\Pipeline', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php', 'line': 110, 'function': 'sendRequestThroughRouter', 'class': 'Illuminate\Foundation\Http\Kernel', 'type': '->'}, {'file': '/srv/www/vhosts/schulen/public/index.php', 'line': 52, 'function': 'handle', 'class': 'Illuminate\Foundation\Http\Kernel', 'type': '->'}]}
[Finished in 5.5s]

Answer

you need to decode xsrf before pass it in headers

import urllib.parse
import requests
from requests import Session
session = Session()
data = '{"type":"Advanced","eingabe":null,"filters":{"classifications":["Gymnasium - SEK I -"],"lschb":[],"towns":[],"countys":[],"regions":[],"features":[],"bbs_classifications":[],"bbs_occupations":[],"bbs_orientations":[],"plz":0,"oeffentlich":"on","privat":"on"}}'
r = session.get('https://schulen.nibis.de/school/search')

xsrf=urllib.parse.unquote(r.cookies['XSRF-TOKEN'])
HEADERS = {'user-agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36',
            'x-xsrf-token':xsrf,
            'x-requested-with': 'XMLHttpRequest',
            'content-type': 'application/json;charset=UTF-8',
            'x-inertia': 'true',
            'x-inertia-version': '207fd484b7c2ceeff7800b8c8a11b3b6',
            'accept-encoding': 'gzip, deflate, br',
            'accept-language': 'en-US,en;q=0.9,hi-IN;q=0.8,hi;q=0.7,ur-IN;q=0.6,ur;q=0.5,ko-KR;q=0.4,ko;q=0.3'}
res = session.post('https://schulen.nibis.de/school/search', data=data, headers=HEADERS)
print(res.json())