With all the vibe coding going around, ESPN is starting to tightly secure their API
I have a C# app created like 4 years ago that would hit endpoints like this "https://site.api.espn.com/apis/site/v2/sports/basketball/nba/news" for news. No authentication was required. All of sudden like a month ago, it stopped working. I got around to debugging today, and noticed that it's returning
"403 Access Denied You don't have permission to access "http://site.api.espn.com/apis/site/v2/sports/basketball/nba/news?" on this server. https://errors.edgesuite.net/18.1cbbd717.1786840874.354481ea".
Tried the same request in postman and browser, no issues. It's not an IP block since the app, postman, and browser are all running local. Doesn't look like header issue either as I have passed every header that postman sends. Still trying to figure out what's going on. Looks like the request is being blocked by Akamai at the CDN/security layer, before ESPN's API server gets the request. I'm afraid to check what other API endpoint are getting locked.
I'm not surprised that all these fantasy platform are starting to lockdown their API because of all these vibe coders hitting their services. Yahoo is now requiring formal request. Sleeper is in talks to make their API paid. Espn has this new security blocker.
This is going to get more interesting in the future. I could see all these fantasy platform doing a complete shutdown of their api.