The signing input is ASCII(base64url(protected header) ‖ "." ‖ base64url(payload)), and the signature or MAC is computed over exactly those bytes, so re-encoding the header or payload invalidates it. The compact serialization (§3.1, §7.1) carries one signature and a protected header; the JSON serialization (§7.2) allows several signatures and unprotected header members.
Header parameters (§4.1): alg (required), kid, typ, cty, crit, and key-carrying members jwk, jku, x5c, x5u, x5t and x5t#S256, which must never be trusted to select a verification key on their own. RFC 7797 adds b64: false for unencoded payloads, used by detached signatures such as Open Banking's x-jws-signature header.
Every JWT you meet is almost always a JWS; ACME requests, DPoP proofs, SD-JWT issuer signatures and many webhook signatures are JWS too.