The test was local, ie using the loopback interface on a large server.

Are you actually going to the DB or is that json synthetically generated? Is it the same json? What exactly are we testing here?

Sorry I was oversimplifying. Most of the data for the response comes from the db with some API calls for authorization and some auxiliary data. Benchmark was actually hitting the DB. Quite a bit of the 1mb response size is redundant (json-api format).