The library in my town has a Web site that allows you to check books out online and pick them up at the library. I would like to write a custom program to do this from the command line on my computer. Is it legal for me to use browser developer tools to reverse engineer the APIs? The site has no terms of service link. If it is legal to reverse engineer the site and write my software, is it legal to release my software as open source? I will not use any original code in my program, just the API.

If this is legal for a library Web site, is it also legal to do it with a credit union's website? My membership agreement does not prohibit reverse engineering the site.

  • Sounds like it would be the best thing to ask. I guess they wouldn't mind if you use their APIs using an automated script as long as the use is similar to a human user. But they might not be happy if e.g. you write a program that queries their database with thousands of requests/second.
    – PMF
    May 7, 2022 at 14:33
  • @PMF I've thought about that, but the library site says "Powered by <name of software>", but I'm not sure if it's hosted by the library or the developer. I could ask the developer, but I think asking anyone at the library would just confuse them. At the credit union, would I have to ask someone in high-level management?
    – Someone
    May 7, 2022 at 14:57
  • Wouldn't this be similar to the loss LinkedIn just took regarding website scraping? Basically, if it's exposed to the public, it's available to the public for use, ToS notwithstanding. (zdnet.com/article/…). From a technical perspective the API calls visible within a website's usage are no different than someones name. The "data" itself is publicly exposed and apparently, can be used however the "scraper" decides, as long as the use itself isn't illegal. Seems Oracle and Google's API fight had similar results.
    – mikem
    May 7, 2022 at 17:28
  • The library API is only exposed to library card holders, and the credit union API is only exposed to credit union members. Does this affect anything?
    – Someone
    May 7, 2022 at 22:46
  • "Powered by <name of software>" What's the name of the software? Jun 4, 2022 at 16:02

1 Answer 1


Aspen Discovery is Open Source Software, so your concern about reverse engineering APIs is quite different than I think you expected. Read ByWater Solutions | Frequently Asked Questions about Aspen Discovery for answers on the API and interoperability with other systems.

See GitHub - mdnoble73/aspen-discovery for the code, so there's no need to reverse engineer.

This is the open source license for Aspen Discovery:

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.

I'd still ask the library for permission to use your own APIs against their actual install and their use of Aspen Discovery, because it may very well be hosted by them on their own servers.

However, a credit union website with an API, even an open source API, will be a completely different animal, as they are governed by state and federal financial institution laws. Read your credit union membership agreement and the TOS linked on the credit union site; I'm 99% sure it will say that scraping, reverse engineering or any access by bots is not allowed.

See also Reverse-Engineering an Application without EULA and Is it illegal to reverse engineer an unsecured API

  • Thank you! I wasn't aware Aspen Discovery is open source, thank you! That will make it a lot easier. I'll read my credit union membership agreement again, but I'm almost certain it does not say anything about scraping/reverse engineering the web site.
    – Someone
    Jun 4, 2022 at 18:11
  • I checked again, and there is nothing in my agreement or the ToS restricting how online banking can be used.
    – Someone
    Jun 4, 2022 at 18:18
  • Would financial institution laws prohibit reverse engineering the site in the absence of any clause prohibiting it in the agreement? My program would basically be a desktop equivalent of a mobile banking app.
    – Someone
    Jun 5, 2022 at 5:55
  • Probably; and there's the en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act All banks usually (hopefully) have lots of security in place, and their systems can detect access attempts (real, bot and/or hacker) and they would at least track your IP address. And probably don't bother asking banks to let you play with their systems to develop an App; there are far too many security and liability concerns for them. Jun 5, 2022 at 19:07
  • okay, thank you. Could asking them hurt anything other than wasting some time? (e.g. would they put me on some kind of watchlist for asking?)
    – Someone
    Jun 5, 2022 at 20:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .