Logged-out .json endpoints return 403
- Provider
- Endpoint
GET /**/*.json- Effective
- 2026-05-30
- Severity
- high
- Change
- auth
- Status
- unverified (secondary reports only; SHAPI does not open fix PRs for it)
What changed
Unauthenticated requests to Reddit's public .json listing endpoints (for example /r/{subreddit}/top.json) started returning 403 Forbidden around 2026-05-30. Reddit announced the shutdown of unauthenticated .json endpoints in r/modnews on 2026-05-28 and said logged-in and authenticated access is not affected; the 403 status and the 2026-05-30 date come from third-party reports.
What to do
Move to an approved OAuth app and call oauth.reddit.com with a bearer token. Reddit's notice points developers who need structured access to Devvit.
Sources
- Provider notice (2026-05-28)
- https://web.archive.org/web/20260529180019/https://old.reddit.com/r/modnews/comments/1tq9vxo/protecting_communities_from_scrapers_and_platform/
- https://dev.to/tonywangca/why-reddit-blocked-unauthenticated-json-in-2026-and-how-to-still-get-reddit-data-58b9
- https://bigideasdb.com/reddit-json-403-forbidden
Check your code
bash
npx shapi-cli scan .shapi scan lists the call sites this change affects; shapi fix repairs them test-first when the advisory has an automatic fix. All advisories · Markdown · OSV · JSON