Can an iPad get malware on a file (specifically a .json file)

nah json is just a text file and not a script or executable

the only way you can install apps bad or good ones on a non jailbroken ipad is app store, you can't get stuff from mails, websites or sms or the likes, so they only really have phishing to get at you

Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support

Due to the system architecture of iOS/iPadOS, unless jailbroken (don’t go there!), your iPad is not susceptible to traditional malware infection per-se. However, as with all computer systems, there are still vulnerabilities and exploits to which you remain vulnerable. Also consider that whilst your iPad may not itself be directly susceptible to malware, downloaded files may still be infected - and if transferred to other computers may still pose a risk of infecting others.

Browser-based attacks can largely be mitigated by installing a good, trusted, Content and Ad-blocking product. One of the very best and most respected within the Apple App Store - designed for iPad, iPhone and Mac - is 1Blocker for Safari.

https://apps.apple.com/gb/app/1blocker-for-safari/id1365531024

1Blocker is highly configurable - and crucially does not rely upon an external proxy-service of dubious provenance. All processing takes place on your device - and contrary to expectations, Safari will run faster and more efficiently. 

Unwanted content is not simply filtered after download (a technique used by basic/inferior products), but instead undesirable embedded content blocked form download. A further benefit on metered services, such as cellular connections where you data may be capped or chargeable, this not only improves speed but also saves you money.

A further measure to improve protection is to use a trusted Recursive DNS Service in preference to automatic settings. This can either be set on a per-device basis in Settings, or can be set-up on your home Router. I strongly recommend using one of the following services - for which IPv4 and IPv6 server addresses are listed:

Quad9 (recommended)

9.9.9.9

149.112.112.112

2620:fe::fe

2620:fe::9

OpenDNS

208.67.222.222

208.67.220.220

2620:0:ccc::2

2620:0:ccd::2

Cloudflare+APNIC

1.1.1.1

1.0.0.1

2606:4700:4700::1111

2606:4700:4700::1001

Use of the above DNS services will help to shield you from “known bad” websites and URLs - and when used alongside 1Blocker, provides defense in depth.

no, nothing you can download will act as a active software that can run on the ios device because of apples sandboxing system

App Sandbox | Apple Developer Documentation

and app can't access outside of it's own data spectrum

Whilst iPad is not susceptible to traditional malware, there are still many vulnerabilities to which present threats. If this were not the case, Apple would have no need to release regular updates that include mitigation for exploits. As such, you should remain vigilant and exercise appropriate computing hygiene - and only download or attempt to access files that are both trusted and of known provenance.

Many malicious files do not themselves contain a damaging payload - but may trigger an exploit a download or other exploit.