diff --git a/include/asterisk/ari.h b/include/asterisk/ari.h
index f5b76f8dcb8d81d8ddee78a419bb89547ba0f698..00769eea56f641cb4a4e63599728c1b8c06c7477 100644
--- a/include/asterisk/ari.h
+++ b/include/asterisk/ari.h
@@ -214,7 +214,7 @@ __attribute__((format(printf, 4, 5)));
  * \brief Fill in an \c OK (200) \a ast_ari_response.
  * \param response Response to fill in.
  * \param message JSON response.  This reference is stolen, so just \ref
- *                ast_json_incref if you need to keep a reference to it.
+ *                ast_json_ref if you need to keep a reference to it.
  */
 void ast_ari_response_ok(struct ast_ari_response *response,
 			     struct ast_json *message);
@@ -226,6 +226,10 @@ void ast_ari_response_no_content(struct ast_ari_response *response);
 
 /*!
  * \brief Fill in a <tt>Created</tt> (201) \a ast_ari_response.
+ * \param response Response to fill in.
+ * \param url URL to the created resource.
+ * \param message JSON response.  This reference is stolen, so just \ref
+ *                ast_json_ref if you need to keep a reference to it.
  */
 void ast_ari_response_created(struct ast_ari_response *response,
 	const char *url, struct ast_json *message);
diff --git a/res/ari/resource_applications.c b/res/ari/resource_applications.c
index aef939005d9055811c66059d749744ba903df1f9..85a631a0256a75a2edf955456785e2db00ccf0ab 100644
--- a/res/ari/resource_applications.c
+++ b/res/ari/resource_applications.c
@@ -68,15 +68,14 @@ void ast_ari_applications_list(struct ast_variable *headers,
 		return;
 	}
 
-
-	ast_ari_response_ok(response, json);
+	ast_ari_response_ok(response, ast_json_ref(json));
 }
 
 void ast_ari_applications_get(struct ast_variable *headers,
 	struct ast_ari_applications_get_args *args,
 	struct ast_ari_response *response)
 {
-	RAII_VAR(struct ast_json *, json, NULL, ast_json_unref);
+	struct ast_json *json;
 
 	json = stasis_app_to_json(args->application_name);
 
@@ -113,7 +112,7 @@ void ast_ari_applications_subscribe(struct ast_variable *headers,
 
 	switch (res) {
 	case STASIS_ASR_OK:
-		ast_ari_response_ok(response, json);
+		ast_ari_response_ok(response, ast_json_ref(json));
 		break;
 	case STASIS_ASR_APP_NOT_FOUND:
 		ast_ari_response_error(response, 404, "Not Found",
@@ -152,7 +151,7 @@ void ast_ari_applications_unsubscribe(struct ast_variable *headers,
 
 	switch (res) {
 	case STASIS_ASR_OK:
-		ast_ari_response_ok(response, json);
+		ast_ari_response_ok(response, ast_json_ref(json));
 		break;
 	case STASIS_ASR_APP_NOT_FOUND:
 		ast_ari_response_error(response, 404, "Not Found",
diff --git a/res/ari/resource_bridges.c b/res/ari/resource_bridges.c
index 16f26279b0d558f0273798dd0ead342308dcb661..9f6562b507cf629a33b52af468ae802d906dc901 100644
--- a/res/ari/resource_bridges.c
+++ b/res/ari/resource_bridges.c
@@ -411,7 +411,7 @@ void ast_ari_bridges_play(struct ast_variable *headers,
 	play_channel = NULL;
 	control = NULL;
 
-	ast_ari_response_created(response, playback_url, json);
+	ast_ari_response_created(response, playback_url, ast_json_ref(json));
 }
 
 void ast_ari_bridges_record(struct ast_variable *headers,
@@ -566,7 +566,7 @@ void ast_ari_bridges_record(struct ast_variable *headers,
 	record_channel = NULL;
 	control = NULL;
 
-	ast_ari_response_created(response, recording_url, json);
+	ast_ari_response_created(response, recording_url, ast_json_ref(json));
 }
 
 void ast_ari_bridges_start_moh(struct ast_variable *headers,
diff --git a/res/ari/resource_channels.c b/res/ari/resource_channels.c
index c6900f1b21a2d8d049e93828dd49dcf79010b8ab..e6322a37c8f6989daa3681625554276780662df9 100644
--- a/res/ari/resource_channels.c
+++ b/res/ari/resource_channels.c
@@ -362,7 +362,7 @@ void ast_ari_channels_play(struct ast_variable *headers,
 	RAII_VAR(struct ast_channel_snapshot *, snapshot, NULL, ao2_cleanup);
 	RAII_VAR(struct stasis_app_playback *, playback, NULL, ao2_cleanup);
 	RAII_VAR(char *, playback_url, NULL, ast_free);
-	RAII_VAR(struct ast_json *, json, NULL, ast_json_unref);
+	struct ast_json *json;
 	const char *language;
 
 	ast_assert(response != NULL);
@@ -434,7 +434,7 @@ void ast_ari_channels_record(struct ast_variable *headers,
 	RAII_VAR(struct ast_channel_snapshot *, snapshot, NULL, ao2_cleanup);
 	RAII_VAR(struct stasis_app_recording *, recording, NULL, ao2_cleanup);
 	RAII_VAR(char *, recording_url, NULL, ast_free);
-	RAII_VAR(struct ast_json *, json, NULL, ast_json_unref);
+	struct ast_json *json;
 	RAII_VAR(struct stasis_app_recording_options *, options, NULL,
 		ao2_cleanup);
 	RAII_VAR(char *, uri_encoded_name, NULL, ast_free);
diff --git a/res/ari/resource_device_states.c b/res/ari/resource_device_states.c
index 50b87674028a2e729bcc190b4ddebe010b684110..621910e1c9737a0a950c1ae0d3a38a2e54ca8fe4 100644
--- a/res/ari/resource_device_states.c
+++ b/res/ari/resource_device_states.c
@@ -35,7 +35,7 @@ void ast_ari_device_states_list(
 	struct ast_ari_device_states_list_args *args,
 	struct ast_ari_response *response)
 {
-	RAII_VAR(struct ast_json *, json, NULL, ast_json_unref);
+	struct ast_json *json;
 
 	if (!(json = stasis_app_device_states_to_json())) {
 		ast_ari_response_error(response, 500,
@@ -50,7 +50,7 @@ void ast_ari_device_states_get(struct ast_variable *headers,
 	struct ast_ari_device_states_get_args *args,
 	struct ast_ari_response *response)
 {
-	RAII_VAR(struct ast_json *, json, NULL, ast_json_unref);
+	struct ast_json *json;
 
 	if (!(json = stasis_app_device_state_to_json(
 		      args->device_name, ast_device_state(args->device_name)))) {
diff --git a/res/ari/resource_endpoints.c b/res/ari/resource_endpoints.c
index 7dab25b9c99d7272b6d96aef5d90532b52043f12..2f47b1a1a036b1a45d018919bcc428f7e7230c28 100644
--- a/res/ari/resource_endpoints.c
+++ b/res/ari/resource_endpoints.c
@@ -158,7 +158,7 @@ void ast_ari_endpoints_get(struct ast_variable *headers,
 	struct ast_ari_endpoints_get_args *args,
 	struct ast_ari_response *response)
 {
-	RAII_VAR(struct ast_json *, json, NULL, ast_json_unref);
+	struct ast_json *json;
 	RAII_VAR(struct ast_endpoint_snapshot *, snapshot, NULL, ao2_cleanup);
 
 	snapshot = ast_endpoint_latest_snapshot(args->tech, args->resource);
@@ -174,5 +174,5 @@ void ast_ari_endpoints_get(struct ast_variable *headers,
 		return;
 	}
 
-	ast_ari_response_ok(response, ast_json_ref(json));
+	ast_ari_response_ok(response, json);
 }
diff --git a/res/ari/resource_playbacks.c b/res/ari/resource_playbacks.c
index 0dbfc0545409ac0b4e11125bb3f8affc96a96acd..3ef6710acefe62f404cb00469292014cce595096 100644
--- a/res/ari/resource_playbacks.c
+++ b/res/ari/resource_playbacks.c
@@ -35,7 +35,7 @@ void ast_ari_playbacks_get(struct ast_variable *headers,
 	struct ast_ari_response *response)
 {
 	RAII_VAR(struct stasis_app_playback *, playback, NULL, ao2_cleanup);
-	RAII_VAR(struct ast_json *, json, NULL, ast_json_unref);
+	struct ast_json *json;
 
 	playback = stasis_app_playback_find_by_id(args->playback_id);
 	if (playback == NULL) {
@@ -51,7 +51,7 @@ void ast_ari_playbacks_get(struct ast_variable *headers,
 		return;
 	}
 
-	ast_ari_response_ok(response, ast_json_ref(json));
+	ast_ari_response_ok(response, json);
 }
 void ast_ari_playbacks_stop(struct ast_variable *headers,
 	struct ast_ari_playbacks_stop_args *args,
diff --git a/res/ari/resource_recordings.c b/res/ari/resource_recordings.c
index 418e3be63e8396dd61f653faf004bca3073a6349..abde4f0c0e4cdd60988705fa6f1763bd169ee0f2 100644
--- a/res/ari/resource_recordings.c
+++ b/res/ari/resource_recordings.c
@@ -76,7 +76,7 @@ void ast_ari_recordings_get_stored(struct ast_variable *headers,
 {
 	RAII_VAR(struct stasis_app_stored_recording *, recording, NULL,
 		ao2_cleanup);
-	RAII_VAR(struct ast_json *, json, NULL, ast_json_unref);
+	struct ast_json *json;
 
 	recording = stasis_app_stored_recording_find_by_name(
 		args->recording_name);
@@ -93,7 +93,7 @@ void ast_ari_recordings_get_stored(struct ast_variable *headers,
 		return;
 	}
 
-	ast_ari_response_ok(response, ast_json_ref(json));
+	ast_ari_response_ok(response, json);
 }
 
 void ast_ari_recordings_delete_stored(struct ast_variable *headers,
@@ -142,7 +142,7 @@ void ast_ari_recordings_get_live(struct ast_variable *headers,
 	struct ast_ari_response *response)
 {
 	RAII_VAR(struct stasis_app_recording *, recording, NULL, ao2_cleanup);
-	RAII_VAR(struct ast_json *, json, NULL, ast_json_unref);
+	struct ast_json *json;
 
 	recording = stasis_app_recording_find_by_name(args->recording_name);
 	if (recording == NULL) {
@@ -158,7 +158,7 @@ void ast_ari_recordings_get_live(struct ast_variable *headers,
 		return;
 	}
 
-	ast_ari_response_ok(response, ast_json_ref(json));
+	ast_ari_response_ok(response, json);
 }
 
 static void control_recording(const char *name,
diff --git a/res/res_ari.c b/res/res_ari.c
index 108f6c7e1a0ce9a3189dfee5090a255e1c54a315..f36b8293521a39a60a9dd7bfc980dbcc7d62d448 100644
--- a/res/res_ari.c
+++ b/res/res_ari.c
@@ -253,7 +253,7 @@ void ast_ari_response_error(struct ast_ari_response *response,
 void ast_ari_response_ok(struct ast_ari_response *response,
 			     struct ast_json *message)
 {
-	response->message = ast_json_ref(message);
+	response->message = message;
 	response->response_code = 200;
 	response->response_text = "OK";
 }
@@ -275,7 +275,7 @@ void ast_ari_response_alloc_failed(struct ast_ari_response *response)
 void ast_ari_response_created(struct ast_ari_response *response,
 	const char *url, struct ast_json *message)
 {
-	response->message = ast_json_ref(message);
+	response->message = message;
 	response->response_code = 201;
 	response->response_text = "Created";
 	ast_str_append(&response->headers, 0, "Location: %s\r\n", url);
@@ -465,7 +465,7 @@ void ast_ari_invoke(struct ast_tcptls_session_instance *ser,
 	RAII_VAR(char *, response_text, NULL, ast_free);
 	RAII_VAR(struct stasis_rest_handlers *, root, NULL, ao2_cleanup);
 	struct stasis_rest_handlers *handler;
-	struct ast_variable *path_vars = NULL;
+	RAII_VAR(struct ast_variable *, path_vars, NULL, ast_variables_destroy);
 	char *path = ast_strdupa(uri);
 	char *path_segment;
 	stasis_rest_callback callback;
@@ -839,14 +839,13 @@ static int ast_ari_callback(struct ast_tcptls_session_instance *ser,
 				struct ast_variable *headers)
 {
 	RAII_VAR(struct ast_ari_conf *, conf, NULL, ao2_cleanup);
-	RAII_VAR(struct ast_str *, response_headers, ast_str_create(40), ast_free);
 	RAII_VAR(struct ast_str *, response_body, ast_str_create(256), ast_free);
 	RAII_VAR(struct ast_ari_conf_user *, user, NULL, ao2_cleanup);
 	struct ast_ari_response response = {};
 	int ret = 0;
 	RAII_VAR(struct ast_variable *, post_vars, NULL, ast_variables_destroy);
 
-	if (!response_headers || !response_body) {
+	if (!response_body) {
 		return -1;
 	}
 
@@ -857,6 +856,7 @@ static int ast_ari_callback(struct ast_tcptls_session_instance *ser,
 
 	conf = ast_ari_config_get();
 	if (!conf || !conf->general) {
+		ast_free(response.headers);
 		return -1;
 	}
 
@@ -955,6 +955,7 @@ static int ast_ari_callback(struct ast_tcptls_session_instance *ser,
 	if (response.no_response) {
 		/* The handler indicates no further response is necessary.
 		 * Probably because it already handled it */
+		ast_free(response.headers);
 		return 0;
 	}
 
@@ -964,13 +965,11 @@ static int ast_ari_callback(struct ast_tcptls_session_instance *ser,
 	ast_assert(response.message != NULL);
 	ast_assert(response.response_code > 0);
 
-	ast_str_append(&response_headers, 0, "%s", ast_str_buffer(response.headers));
-
 	/* response.message could be NULL, in which case the empty response_body
 	 * is correct
 	 */
 	if (response.message && !ast_json_is_null(response.message)) {
-		ast_str_append(&response_headers, 0,
+		ast_str_append(&response.headers, 0,
 			       "Content-type: application/json\r\n");
 		if (ast_json_dump_str_format(response.message, &response_body,
 				conf->general->format) != 0) {
@@ -978,16 +977,15 @@ static int ast_ari_callback(struct ast_tcptls_session_instance *ser,
 			response.response_code = 500;
 			response.response_text = "Internal Server Error";
 			ast_str_set(&response_body, 0, "%s", "");
-			ast_str_set(&response_headers, 0, "%s", "");
+			ast_str_set(&response.headers, 0, "%s", "");
 			ret = -1;
 		}
 	}
 
 	ast_http_send(ser, method, response.response_code,
-		      response.response_text, response_headers, response_body,
+		      response.response_text, response.headers, response_body,
 		      0, 0);
 	/* ast_http_send takes ownership, so we don't have to free them */
-	response_headers = NULL;
 	response_body = NULL;
 
 	ast_json_unref(response.message);