Agreed, I think there was no intention to fail in such cases, we just forgot to disable this default Jackson behaviour. Furthermore, the ObjectMapper instances should be configurable, or one should ...

This null check for apiSessions appears to be redundant. The conditional block on lines 128-129 already handles cases where sessionsNode is null, a JSON null, or empty. If execution proceeds past that ...