Can an array be top-level JSON-text?

Yes, an array is legal as top-level JSON-text.

There are four standard documents defining JSON: RFC 4627, RFC 7159 (which obsoletes RFC 4627), ECMA-404, and RFC 8259 (which obsoletes RFC 7159, and calls ECMA-404 normative). They differ in which top-level elements they allow, but all allow an object or an array as the top-level element.

• RFC 4627: Object or array.
  "A JSON text is a serialized object or array."
• RFC 7159, RFC8259: Any JSON value.
  "A JSON text is a serialized value. Note that certain previous specifications of JSON constrained a JSON text to be an object or an array." Section 2
• ECMA-404: Any JSON value.
  "A JSON text is a sequence of tokens formed from Unicode code points that conforms to the JSON value grammar."

Yes, but you should consider making the root an object instead in some scenarios, due to JSON hijacking. This is an information disclosure vulnerability based on overriding the array constructor in JavaScript.

This is from the ECMAScript specification.

JSONText :
    JSONValue

JSONValue :
    JSONNullLiteral 
    JSONBooleanLiteral 
    JSONObject 
    JSONArray 
    JSONString 
    JSONNumber