Whitelisting JSON ARGS_NAMES - apache

Question

I could use some advice on whitelisting JSON ARGS_NAMES that modsecurity seems to complain about. I'm not sure how to properly specify the ARGS_NAMES for a JSON Request. My app uses JSON heavily, so there are a few of these alerts for different style requests.
The following alert is triggered by a POST request (sign-in/authentication) to my backend application:
2015-08-06T23:02:21.09022 [Thu Aug 06 23:02:21.090206 2015] [:error] [pid > 18099:tid 140155981653760] [client 192.168.216.16] ModSecurity: Warning. > Pattern match "(?i:(?:union\\s*?(?:all|distinct|[(!#]?)?\\s?[([]? \\s?select\\s+)|(?:\\w+\\s+like\\s+> [\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98])|(?:like\\\\s*? [\\"'\xc2\xb4\xe2\x80\x99\xe2\x80\x98]\\%)|(?: [\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98]\\\\s*?like\\\\W*? [\\"'\xc2\xb4 ..." at ARGS_NAMES: {"username":"userid2","password":"blahblah"}. [file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "223"] [id "981245"] [msg "Detects basic SQL authentication bypass attempts 2/3"] [data "Matched Data: \x22:\x22userid2\x22,\x22p found within ARGS_NAMES: {\x22username\x22:\x22userid2\x22,\x22password\x22:\x22blahblah\x22 }:{\x22username\x22:\x22userid2\x22,\x22password\x22:\x22blahblah\x22 }"] [severity "CRITICAL"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"][hostname "api.host.name"] [uri "/user-api/auth-service"] [unique_id "VcPnfQobAhEAAEazjWUAAABB"]
Here's another alert triggered by an AJAX update to a user's session data:
2015-07-22T22:02:03.61377 [Wed Jul 22 22:02:03.613737 2015] [:error] [pid > 14702:tid 140281273739008] [client 10.72.2.5] ModSecurity: Access denied > with code 403 (phase 2). Pattern match "(.*)" at TX:981257-Detects MySQL > comment-/space-obfuscated injections and backtick termination- OWASP_CRS/WEB_ATTACK/SQLI-ARGS_NAMES:{"data":{"categories": [{"uuid":"10009","name":"Books","folder":"School"}],"category_ids": ["188"],"transaction_ids":["ed529b9f47ee-ab23-5b98-4404-d59a86b9","ed529b9f47ee-ab23-5b98-4404-d59a86b9","ed529b9f47ee-ab23-5b98-4404-d59a86b9"]}}. [file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_49_inbound_blocking.conf"] [line "26"][id "981176"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20, SQLi=4, XSS=0): Last Matched Message: 981243-Detects classic SQL injection probings 2/2"] [data "Last Matched Data: ,\x22name\x22:"] [hostname "host.name.com"] [uri "/new/data"] [unique_id "VbAS2wobA80AADluSjYAAADw"]
How can I create a whitelist for "ARGS_NAMES:{"username[..]" or "ARGS_NAMES:{data[..]"? When I try to whitelist with regex, I wind up with a rule like this:
SecRule ARGS_NAMES:"({\"(data)\":)(({\"[a-z_]+\":).)" "(.)" "id:308,phase:2,t:none,nolog,pass,ctl:ruleRemoveTargetByTag=.;ARGS_NAMES:({\"(data)\":)(({\"[a-z_]+\":).)"
I believe this works unless PCRE limits exceeded, from testing. Is there an easier way to do this for JSON arguments?
Here's another method I tried in an earlier iteration of my whitelists:
SecRule ARGS:data.transaction_ids "(([a-z0-9-]))" "id:206,phase:2,nolog,pass,ctl:ruleRemoveTargetByTag=.;ARGS:data.transaction_ids,ctl:ruleRemoveTargetById=960024;ARGS:data.transaction_ids"
To the best of my knowledge this works, but I want to be able to whitelist any request that uses the "{data:" JSON format within the request body. I want to verify the correct method of whitelisting JSON arguments before I go in for another round of testing.
What am I missing here?