What Is a Private API? How Integuru Generates Access to Closed Platforms
A private API is the set of HTTP endpoints a web platform uses internally to power its own frontend. Integuru reverse-engineers these endpoints to generate production-ready integrations, with 99.9%+ reliability and sub-3-second response times.
Open the Network tab on a healthcare portal, log in, and navigate to a patient record. Watch the XHR and Fetch requests filter in. What you will see is a stream of clean JSON responses flowing from a backend endpoint to the browser: structured data, low latency, and exactly the shape your integration needs.
The portal may have told you it has no API, but that is not quite accurate. It has one, built for its own frontend and never published for external use, and it is the foundation of how Integuru works.
What is a private API?
A private API is the set of HTTP endpoints a web platform uses internally to power its own frontend, accessible via an authenticated session but never documented, published, or offered to third parties. Integuru identifies and calls these same endpoints directly to generate production-ready API access for platforms that have never published a public API. The platform's own JavaScript calls these endpoints every time you interact with the interface. They return structured JSON or XML data, accept standard request parameters, and handle authentication through session cookies or bearer tokens. The only difference between a private API and a public one is intent: the platform built it for itself, not for you.
Other names for the same concept: internal API, unofficial API, undocumented API. They all mean the same thing: the backend your browser is already talking to.
How private APIs differ from public and partner APIs
A private API differs from public and partner APIs in one key way: it is the infrastructure a platform built for its own frontend, never intended for third-party access, with no documentation, no stability guarantee, and no support program. Public and partner APIs are intentional products; a private API is the backend your browser already uses.
Most platforms that do offer external access do so in one of two ways: a public API (documented, available to any registered developer) or a partner API (restricted to vetted partners who have passed an approval process). Both carry support commitments, while a private API carries none.
Public API | Partner API | Private API | |
|---|---|---|---|
Access method | API key or OAuth, self-serve | Application review, approval process | Authenticated session (same as a logged-in user) |
Documentation | Published and versioned | Provided to approved partners | None; reverse-engineered from traffic |
Stability guarantee | Yes, with change notices | Yes, within program terms | No; can change without warning |
Coverage | Whatever the vendor chose to expose | Scoped to the partner program | Everything the frontend can do |
Time to first request | Minutes to a few days | Weeks to months | Same day, if you know how to find it |
Typical response latency | Varies by vendor; sub-second common | Same as public API | Same as direct HTTP; under 3 sec with Integuru |
Public and partner APIs cover what the platform wants to expose. Private APIs cover everything the interface actually does. For integrations that depend on workflows the platform has not chosen to publish, the private API is often the only option.
Last verified: July 2026
How teams currently access private APIs (and where each approach breaks)
Three approaches come up when developers hit the "no public API" wall, and each one works well enough to ship a prototype. The problems surface at production scale: session expiry, branching logic across accounts, and the maintenance cost that compounds every time the target platform ships a change.
Browser DevTools and manual replay. Open DevTools, filter XHR requests, find the call you need, copy it as curl. You have a working prototype in under an hour. The problem: that request captures one endpoint, from one account, at one point in time. You still need to handle session management, token refresh, 2FA, and the branching logic that appears when you run the same workflow across a thousand accounts with different configuration states.
Proxy interception (mitmproxy, Charles). A proxy sits between the browser and the backend and logs every request, which is more thorough than DevTools for complex flows or mobile app traffic. The engineering work to turn those logs into a maintainable integration is still entirely on you.
Browser automation (Selenium, Puppeteer). Instead of calling the private endpoint directly, these tools launch a headless browser, load the full page, interact with the DOM, and read the result. This works, but it targets the wrong layer. Your integration is coupled to the HTML structure, not the JSON response. When the platform redesigns its frontend, your selectors break. A backend deploy that does not touch the API at all can still invalidate every automation script you have written.
HTML changes break scraping integrations. The private API endpoint, serving the same
JSONit always has, is unaffected. That is the key stability difference between targeting the right layer and the wrong one.
Response time is the second problem. Browser automation averages 5 to 30 seconds per action because it includes browser startup, asset loading, JavaScript rendering, and DOM interaction (simpler platforms run toward the low end; SPA-heavy systems like EHR portals run toward the high end). A direct HTTP call to the same private endpoint takes under 3 seconds. At any meaningful volume, that gap compounds quickly.
How Integuru generates reliable access to private APIs
Integuru generates production-ready integrations by targeting private APIs directly, not the browser layer on top of them. Integuru analyzes a target site's network traffic, identifies the private HTTP endpoints the frontend calls, handles authentication automatically, and delivers a documented API your team can call from any language or tool, with no browser required.
The process starts with traffic analysis. Integuru's agent authenticates with the target platform and captures the network requests that correspond to each workflow you need to automate. It identifies the private HTTP endpoints, the request parameters, the authentication mechanism, and the response shape. That analysis takes 10 to 20 minutes.
From that analysis, Integuru generates a documented API: clean endpoints, defined input schemas, and request/response documentation your team can work from immediately. The underlying calls go directly to the platform's private backend, bypassing the browser entirely.
Authentication is handled as part of the integration, including session cookies, bearer tokens, and 2FA. Integuru also covers edge cases automatically: the different account states, subscription tiers, and branching logic paths that appear in real-world usage across a large account population. The integration that works on your test account also works on your customers' accounts.
On the Production plan, a 24/7 on-call maintenance team monitors every integration and handles breakages, including authentication changes that require re-authentication or token rotation. Integuru is backed by Y Combinator and was founded in 2024.
99.9%+ reliability rate across production integrations
Under 3 sec average response time (vs. 5–30 seconds for browser automation, depending on app complexity)
24/7 on-call maintenance included on the Production plan
For a step-by-step look at how the endpoint discovery process works in practice, see type: entry-hyperlink id: 1QmLpq0M5tR6fHWHJynriL.
When private API integration makes sense
Private API access is the right approach for four situations.
No public API exists. Healthcare portals, EHR systems, carrier and freight platforms, legal case management tools, older fintech platforms: most have rich web interfaces and no documented API. The private API is the only programmatic access available. If the platform has a login page and a web interface, it has a private API your team can reach with the right approach.
The public API does not cover what you need. Some platforms publish an API scoped to a subset of functionality. The workflows your team needs to automate sit behind the web interface but not behind the documented API. The private endpoints that power those workflows are still accessible.
Legacy portals and government systems. Many government portals and enterprise internal tools were built before API-first design was standard. They have web frontends, no public API, and no partner program. The only programmatic path in is through the private endpoints those frontends call.
AI agent tool access. AI agents need to interact with web platforms programmatically, but browser-based tool access introduces the same latency and reliability problems that affect browser automation integrations generally. Private API access gives agents low-latency, high-reliability tool calls at any scale your product requires.
For a full comparison of latency, throughput, reliability, and cost across approaches, see type: entry-hyperlink id: 7ELDCHBOg5bNuPGE5jITi1. If you want to understand how "private API," "unofficial API," and "undocumented API" relate to each other, type: entry-hyperlink id: 3ATTZBuOqd38dSTFi7ZEef covers the full terminology map.
Last verified: July 2026
Our Services
If your team needs access to a platform with no public API, Integuru generates a private API integration in under 20 minutes.
The fastest way to start is the CLI:
npm install -g integuru
Or open the web app at app.integuru.com. To talk through your platform and use case, schedule a call here or email us.