copyright data-ownership data-storage
Is scraping a database by an undocumented API endpoint illegal?
<p>Simple question: I want to get specific data, but the API does not have the endpoint I want, so what I want to do is scrape the database for the resources and then use my own filtering to retrieve and display the data part I want. I really don't want to get sued. Any insight would be very much appreciated. </p>

<p>As with any question dealing with accessing, copying and repurposing data, copyright law comes into play. Read <a href="https://law.meta.stackexchange.com/questions/541/i-have-a-question-about-copyright-what-should-i-read-before-i-ask-it">I have a question about copyright. What should I read before I ask it?</a> :</p>

<blockquote>
  <p>Copyright law protects a creator’s right to control certain intangible
  works that they have created, specifically protecting original
  expression but not underlying facts or ideas. Modern copyright law is
  based on the Berne Convention, and in the US, the statutory basis for
  copyright law is Title 17 of the US Code. 17 USC 102(a) states the
  basic rule regarding what is protected: <em>original works of authorship
  fixed in any tangible medium of expression, now known or later
  developed, from which they can be perceived, reproduced, or otherwise
  communicated, either directly or with the aid of a machine or device</em></p>
</blockquote>

<p>That means the data on the site is under copyright.</p>

<p>Now, permission to scrape, use and repurpose the copyrighted data from that site - which is what you want to do - will be covered in the site Terms of Service (TOS). Look for that at the website and read it.</p>

<p>What does the TOS say about accessing and using the data via the API? What are the conditions for data access and usage that the TOS outlines? Does the TOS say you can only access the data; or does it also say you can filter and use their data and display the result?</p>

<p>All those points - and more - should be clearly outlined; if you "don't want to get sued", read the TOS and be sure to comply with its conditions.</p>

<p>It doesn't really matter if the API endpoint is not known or documented; in fact, the TOS may forbid access to data by undocumented endpoints or by any other method other than the API. Read it.</p>

<p>If in fact the TOS does not say anything about accessing with undocumented APIs, ask the site owners if you can access the data by your method. It's much better to go that route and find out, rather than do it anyway, have them find out by log entries, change the TOS to forbid that access, and track you down.</p>

<p>See earlier questions on LSE: <a href="https://law.stackexchange.com/questions/15360/is-it-legal-to-scrape-a-website-and-create-my-own-database/">Is it legal to scrape a website and create my own database?</a> and <a href="https://law.stackexchange.com/questions/15556/is-scraping-real-estate-data-illegal-in-anyway">Is scraping real estate data illegal in anyway?</a> and <a href="https://law.stackexchange.com/questions/15553/can-i-legally-scrape-data-from-a-website-for-use-in-my-app/">Can I legally scrape data from a website for use in my app?</a></p>
