Reverse engineering a website API