Is Every JSON REST API HATEOAS?

No.

An API can use HTTP verbs, resource-oriented URLs, JSON, status codes, and stateless requests while still not implementing HATEOAS.

For example, if a client is programmed with /orders/{id}/payment and knows this URI independently of server responses, it is not relying on hypermedia to discover the transition.

HATEOAS is often omitted because it increases implementation and client-design complexity. Nevertheless, understanding it is important because it is a formal REST constraint and can be valuable for discoverable, state-driven APIs.