united-states hacking
Is it legal to reverse engineer Web APIs used by websites?
<p>The library in my town has a Web site that allows you to check books out online and pick them up at the library. I would like to write a custom program to do this from the command line on my computer. Is it legal for me to use browser developer tools to reverse engineer the APIs? The site has no terms of service link. If it is legal to reverse engineer the site and write my software, is it legal to release my software as open source? I will not use any original code in my program, just the API.</p>
<p>If this is legal for a library Web site, is it also legal to do it with a credit union's website? My membership agreement does not prohibit reverse engineering the site.</p>

<p>Aspen Discovery is Open Source Software, so your concern about reverse engineering APIs is quite different than I think you expected. Read <a href="https://bywatersolutions.com/education/frequently-asked-questions-about-aspen-discovery" rel="nofollow noreferrer">ByWater Solutions | Frequently Asked Questions about Aspen Discovery</a> for answers on the API and interoperability with other systems.</p>
<p>See <a href="https://github.com/mdnoble73/aspen-discovery" rel="nofollow noreferrer">GitHub - mdnoble73/aspen-discovery</a> for the code, so there's no need to reverse engineer.</p>
<p>This is the open source license for Aspen Discovery:</p>
<blockquote>
<p>This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 2 of the License, or (at
your option) any later version.</p>
</blockquote>
<p>I'd still ask the library for permission to use your own APIs against their actual install and their use of Aspen Discovery, because it may very well be hosted by them on their own servers.</p>
<p>However, a credit union website with an API, even an open source API, will be a completely different animal, as they are governed by state and federal financial institution laws. Read your credit union membership agreement and the TOS linked on the credit union site; I'm 99% sure it will say that scraping, reverse engineering or any access by bots is not allowed.</p>
<p>See also <a href="https://law.stackexchange.com/questions/6852/reverse-engineering-an-application-without-eula">Reverse-Engineering an Application without EULA</a> and <a href="https://law.stackexchange.com/questions/1990/is-it-illegal-to-reverse-engineer-an-unsecured-api">Is it illegal to reverse engineer an unsecured API</a></p>
