[systematical]

That really depends. What if they require a login that uses a cookie based session? What about CSRF tokens? What if they put in a captcha cause your requests look funny. At some point it quickly goes from API to BOT.