Rails params: where did _json come from, and how do I whitelist it's contents?

Question

I am writing a Rails API and attempting to create multiple records at the same time by passing a JSON array into the controller, like this:

[
    {
        &q