My question is how to create _Token[fields] and _Token[debug] ? Because I have no form but only a json object when sending data. I have the header with the csrfToken hash!
For ajax json requests you should disable the security component for the target action. Those hashes are built based on a form that is created with the form helper (To prevent form tampering). It doesn’t really work, and isn’t really applicable to ajax/json requests.