I've reverse engineered a Taobao APP's undocumented API to make a helper program, (in case you don't know what Taobao APP is, it's like amazon or ebay), this API allows the APP to place bids and make purchases.

Some products on Taobao APP need the user to place order very quickly (often there is a specific time that the product will be open for order.), if you can place your order before others you will get a better price. I'm sure it works the same way as ebay bid sniping.

My program with the API can allow users to login to Taobao account and place orders automatically, the end user can specify what product they want to order and the program will read the product's start time (public information) and a timer within the program will start a countdown, at the end of the countdown the order is placed automatically. (normally the end user will have to login to Taobao APP and click on the Buy Now button to complete the order, but that will be too slow).

After the order is successfully placed (yes it can be unsuccessful if others front run), the end user can then proceed to Taobao APP and complete the payment.

Suppose Taobao is an American company and operating in the U.S, and I created such a program, would this be illegal under the U.S law?

(the API contains a Key and a secret, together they can cryptographically sign a piece of information to verify that the information is not tempered with during data transit, if it's been tempered with the information will not go through.)

Thanks for your time.


The only difficulty I can imagine is that related to accessing data that belongs to someone else. I have seen a number of stipulations in user agreements that say I will not access the site using a bot, web-crawler, indexing software, nor a number of other things. Notice that none of these relate to the API, yet could still cause you issues if the data owner doesn't want anyone accessing the data that way. For example, here is a quote of Amazon's user agreement (accessed 12/25/21):

Subject to your compliance with these Conditions of Use and any Service Terms, and your payment of any applicable fees, Amazon or its content providers grant you a limited, non-exclusive, non-transferable, non-sublicensable license to access and make personal and non-commercial use of the Amazon Services. This license does not include any resale or commercial use of any Amazon Service, or its contents; any collection and use of any product listings, descriptions, or prices; any derivative use of any Amazon Service or its contents; any downloading, copying, or other use of account information for the benefit of any third party; or any use of data mining, robots, or similar data gathering and extraction tools. All rights not expressly granted to you in these Conditions of Use or any Service Terms are reserved and retained by Amazon or its licensors, suppliers, publishers, rightsholders, or other content providers. No Amazon Service, nor any part of any Amazon Service, may be reproduced, duplicated, copied, sold, resold, visited, or otherwise exploited for any commercial purpose without express written consent of Amazon.

Copying the API functionality is not much of an issue, but as you can see, reading and writing the data on the other side definitely is. I suggest looking at the user agreement for the site (if there is one), and if they don't seem to object to your app's access, contacting them to ask permission. If a mutually beneficial arrangement can be found, they may be open to it. This is always preferable to legal action, in my opinion.

Take care that your use of the crypto part of the API can't be interpreted as your messages representing themselves as being from someone else. In some circumstances, this could be fraud.

  • 2
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Dec 25 '21 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.