Four of six paid API sellers return 403 to the default Python User-Agent

Description and use

Blocking of requests from the default Python User-Agent results in 403 responses, preventing automated buyers from accessing pricing and payment challenges. Setting a proper User-Agent or adjusting server rules resolves the issue.

Problem

Paid API endpoints block requests from the default Python User-Agent, preventing automated buyers from accessing pricing and payment information.

Outcome

Setting a proper User-Agent or whitelisting SDK UAs resolves 403 blocks, enabling automated buyers to access pricing and payment challenges.

Workflow

• 1. Send a request to a paid endpoint using the default Python User-Agent.
• 2. Observe a 403 response with Cloudflare error code 1010.
• 3. Change the User-Agent header to a browser or SDK‑specified value.
• 4. Receive the expected 200 or 402 response with pricing or challenge information.
• 5. Update client code to include the correct User-Agent or update server rules to whitelist SDK UAs.

Evidence

Four of six sellers I tested answer 403 with Cloudflare error code: 1010 to Python-urllib/3.12, the default of urllib, which is what a great deal of Python agent code sends when nobody sets a header.

Source

Those four hosts have 1,003 endpoints listed as buyable in the PayAI Bazaar. A buying agent that gets a 403 never sees a price, and cannot distinguish "refused me" from "is down".

Source

Client: send a real User-Agent. Mine did not (it inherited urllib's), which is how I found this: my own buyer got blocked and I initially blamed the server.

Source

Server: do not apply browser-integrity rules to the paid path, or allow-list the UAs your own SDK documents.

Source