# Logged-out .json endpoints return 403

- **Provider:** Reddit
- **Endpoint:** `GET /**/*.json` on `reddit.com`, `www.reddit.com`, `old.reddit.com`
- **Effective:** 2026-05-30
- **Severity:** high
- **Change:** auth
- **Status:** unverified (secondary reports only; SHAPI does not open fix PRs for it)

## What changed

Unauthenticated requests to Reddit's public .json listing endpoints (for example /r/{subreddit}/top.json) started returning 403 Forbidden around 2026-05-30. Reddit announced the shutdown of unauthenticated .json endpoints in r/modnews on 2026-05-28 and said logged-in and authenticated access is not affected; the 403 status and the 2026-05-30 date come from third-party reports.

## What to do

Move to an approved OAuth app and call oauth.reddit.com with a bearer token. Reddit's notice points developers who need structured access to Devvit.

## Sources

- Provider notice (2026-05-28): https://www.reddit.com/r/modnews/comments/1tq9vxo/protecting_communities_from_scrapers_and_platform/
- https://web.archive.org/web/20260529180019/https://old.reddit.com/r/modnews/comments/1tq9vxo/protecting_communities_from_scrapers_and_platform/
- https://dev.to/tonywangca/why-reddit-blocked-unauthenticated-json-in-2026-and-how-to-still-get-reddit-data-58b9
- https://bigideasdb.com/reddit-json-403-forbidden

## Machine-readable

- Advisory: https://github.com/SriVarshini09/shapi-advisories/blob/main/advisories/reddit-logged-out-json-403.json
- OSV: https://shapi.dev/osv/reddit-logged-out-json-403.json