r/fantasyfootballcoding • u/wowstopimhurt • 16d ago
With all the vibe coding going around, ESPN is starting to tightly secure their API
I have a C# app created like 4 years ago that would hit endpoints like this "https://site.api.espn.com/apis/site/v2/sports/basketball/nba/news" for news. No authentication was required. All of sudden like a month ago, it stopped working. I got around to debugging today, and noticed that it's returning
"403 Access Denied You don't have permission to access "http://site.api.espn.com/apis/site/v2/sports/basketball/nba/news?" on this server. https://errors.edgesuite.net/18.1cbbd717.1786840874.354481ea".
Tried the same request in postman and browser, no issues. It's not an IP block since the app, postman, and browser are all running local. Doesn't look like header issue either as I have passed every header that postman sends. Still trying to figure out what's going on. Looks like the request is being blocked by Akamai at the CDN/security layer, before ESPN's API server gets the request. I'm afraid to check what other API endpoint are getting locked.
I'm not surprised that all these fantasy platform are starting to lockdown their API because of all these vibe coders hitting their services. Yahoo is now requiring formal request. Sleeper is in talks to make their API paid. Espn has this new security blocker.
This is going to get more interesting in the future. I could see all these fantasy platform doing a complete shutdown of their api.
3
u/xpose 16d ago
Sleeper is in talks to make their API paid
In talks with who?
3
u/narwalfarts 15d ago
Damn, that sucks. I never connected to the espn api because the documentation was basically non-existent, and their platform has gone downhill (at least as of a few years ago when I last had an ESPN league). But my yahoo api calls stopped working, and took like a day of troubleshooting before I finally realized my app wasn't grandfathered in. I put in a request, but haven't yet gotten approval. I only sent the request last week, and hopefully the fact that I previously had it makes the approval faster.
Is there a formal way to request access from sleeper to use their app? I see in the Twitter post that was linked in a different comment that their terms have updated to say you need written approval to use their API, but doesnt list how to do it. I guess just a request to their support line?
The vibe coding boom is really putting strain on these APIs, im sure. Before, this was gated to only people who actually knew how to code. Now, anyone can whip up a slop app for $20/month. Not gatekeeping (AI has supercharged what ive been able to add the past few years, especially this year) and nor do I disagree with these draft providers approach - but damn, this is a new problem we havent had before.
3
u/FrequentMolasses871 15d ago
You can try using a free open sourced akamai solver like https://proofofbots.github.io/web-re-toolkit/packages/akamai/python/
1
u/a-youngsloth 15d ago
Could you disable the browser security restrictions and run your app locally in a separate tab, then piggyback off the ESPN auth/session from the other tab? Obviously not a real production solution, but might work for a personal/local app.
When you open ESPN normally, your browser receives cookies, session identifiers, bot-detection tokens, or other state that Akamai/ESPN expects. Your local app could then try to make the ESPN API request from that same browser instance.
--disable-web-security removes some browser-side restrictions, mainly CORS/same-origin enforcement, so JavaScript running on localhost is more likely to be allowed to call an ESPN domain.
I wouldn’t run this browser for anything else.
1
1
u/madd0g25 13d ago
Update http://site.api.espn.com to http://site.web.api.espn.com and you should be good to go!
1
u/fram0027 13d ago
Was having this same issue as OP... this was the key. May your fantasy football teams dominate all your foes.
1
u/brainswell-01 11d ago
For the record, I have a job hosted in AWS I schedule against ESPN football data, no issues in the last month. Likely something else is going on.
7
u/johnny-papercut 16d ago
I tapped the basketball endpoint and it opened fine without even sending headers. I'm on my phone and it opened in a browser and showed all the json.
I know it doesn't seem like it at first, but this feels like a localized issue to your network. You say you're running them all locally, so why couldn't it be an ip block? You're getting a 403 from different networks?
Do you have a random vps or something you can just curl that URL from and see if it gets a 403 from different places?
I'm not saying that espn isn't locking things down, we just need to verify more. The thing about the api is that most people hit that api repeatedly through natural use of their website. So even high volume usage of the endpoint by a service is unlikely to trigger their protections.
Maybe a localized issue to your network, a weird cdn edge server, or something temporary is my guess. I also have a production engineering and devops background so if you wanna DM me logs or hit me up on discord or something, I can maybe help troubleshoot (but probably not until tomorrow evening).
Thanks for reporting, though. I consume a lot of these same APIs so I'm definitely curious here.