Earn a session in a browser, then call the site's own API with it. GPAL does that two ways, in the page and outside it, and this bot runs both against the same session so you can see which wall you are at rather than guessing.