Right you are, Corion. Here is working code, in case anyone else is trying to do this. The other tricky thing was how to pass the short URL: Not the hash, and not the whole URL, but the domain plus the hash. I can't imagine why that do it that way instead of just using the hash. It's not like they're going to be lengthening non-bitly URLs :-/

use LWP::UserAgent;
use JSON::XS;
our $browser = LWP::UserAgent->new(timeout => 30);
my $url = 'https://api-ssl.bitly.com/v4/expand';
my $header = ['Authorization' => 'Bearer 1a2b3c4d5e']; # use a valid o
+ne instead of this made-up one
my $data = {"bitlink_id" => 'bit.ly/361RdUL'}; # note domain is includ
+ed
my $encoded_data = encode_json($data);
my $r = HTTP::Request->new('POST', $url, $header, $encoded_data);
my $response = $browser->request($r);
my $foo = 1;
if ($response->is_success) {
    print $response->decoded_content;
}
else {
    die $response->status_line;
}
[download]