Mercado Libre search API returns blanket 403, breaking JSON scrapers on every proxy tier

Mercado Libre has stopped serving anonymous requests on its public search API, according to a technical write-up published on dev.to by a scraping operator. Calls to api.mercadolibre.com/sites/MLA/search (and the MLM equivalent) now return HTTP 403 with a short JSON body saying "forbidden", and the author reports the response was identical across four separate setups: a home broadband connection, an unproxied cloud runner, a datacenter proxy, and a residential proxy pinned to Mexico and Argentina. The author's reading is that this is a deliberate authentication wall rather than bot detection reacting to fingerprints, because the outcome does not change with the proxy tier. The practical consequence they draw: a JSON-based Mercado Libre search scraper no longer works at all.

A 200 response that hides a block

The HTML search page survives, but the failure mode for weak IP addresses is easy to misread. According to the post, requests to the Mexican listing page from datacenter or bare-runner IPs return HTTP 200 with a roughly 25.6 KB body that is a frontend bundle the marketplace serves for suspicious traffic. It contains none of the markers of a real results page, so it looks like success in a log but parses as empty.

Only the residential-proxy request received something different: a smaller page with the genuine title, a proof-of-work payload, and a cookie written after the computation runs. The author's takeaway is that an identical status code can mean a decoy, a solvable challenge, or the real page, and the three only separate when you inspect the response body.

The fix was memory, not evasion

The most instructive finding in the post concerns container resources rather than anti-bot circumvention. Mercado Libre's search page renders a DOM of roughly 3.3 MB. At 4096 MB of memory, the author's Camoufox-based browser was killed mid-render and threw an error that looks exactly like the target closing the connection. The same code at 8192 MB cleared 9 of 10 attempts, versus 6 of 12 at the lower setting, with the single failure being an account-verification page rather than a hard block. The sample sizes are small, and this is a single operator's benchmark, but the underlying lesson is worth noting: an out-of-memory browser crash and a hostile target produce the same error signature, and confusing the two yields block-rate statistics that reflect your own infrastructure rather than the site's defenses.

Pagination holds after one clearance

Once a session clears the challenge, deeper pages come cheap. The author reports that walking offsets 49 through 385 — pages two through nine at 48 results per page — returned real pages of 2.65 to 2.77 MB with 54 to 59 result cards each, across four separate attempts, with no repeat challenge or captcha wall. The residential-proxy cost is paid once per run, and the rest of the pagination happens inside the cleared context.

The post also documents a pagination trap: the arithmetically obvious page-two URL pattern is answered with a redirect back to page one, so an overlap check comparing page one to page two was silently comparing page one to itself. The real page-two URL uses a 49-result offset with a no-index flag, and the bug only surfaced when the author logged the final URL after redirects instead of the requested one.

What the operator's tool does

The write-up doubles as promotion for an Apify Actor, so the commercial details are the author's own. It supports the Mexican domain only, returns organic results (item ID, title, seller, rating, prices, discounts, installments, shipping, URL, currency and a timestamp), excludes sponsored placements and recommendation carousels, and rotates sessions and exit IPs on recoverable refusals. Pricing is $0.20 per run plus half a cent per row, which works out to about $5.20 per 1,000 results.

Why it matters

Open-but-undocumented JSON endpoints have long been the quiet backbone of price monitoring and market research. When a major marketplace walls one off — not with fingerprinting that a better client can beat, but with a plain requirement to authenticate — the remaining path is a full browser, a proof-of-work challenge and residential IPs, which sharply raises the cost of collecting publicly displayed data. For scraping engineers, the story is also a diagnostic warning: before concluding a target is too well defended, check whether your own container had enough memory to finish rendering the page.