Extract Hidden Goethe Website APIs

I need a seasoned backend developer who can dive into the Goethe website, watch the traffic, and uncover the private APIs it relies on. The assignment revolves around pure data extraction: I’m not after public pages or scraped HTML—I want the actual endpoints, request patterns, headers, tokens, and any quirks the site uses to return its data. The ultimate purpose is research, so accuracy and completeness matter more than production-ready code.

What makes this tricky is that nothing is documented. You’ll be inspecting XHR calls in the browser, replaying them with tools such as Postman, cURL, or mitmproxy, and reverse-engineering whatever signature or authentication flow the Goethe backend expects. If rate limits, CSRF tokens, or session cookies come into play, I’ll count on you to map those out too.

Deliverables
• A concise report (Markdown or PDF) listing every discovered endpoint, required parameters, authentication steps, and typical response structures.
• A working Postman (or similar) collection that reproduces each call successfully.
• Optional but appreciated: a small proof-of-concept script in Python or Node.js that fetches one endpoint end-to-end.

Acceptance criteria
1. All endpoints return the same data in your demo as they do inside the live site.
2. No manual browser interaction needed once cookies or tokens are captured per your documentation.
3. Clear explanation of any limitations (rate limits, IP blocks, time-sensitive tokens).

Please bid only if you have a verified history of API discovery or reverse engineering. When you reply, briefly outline a comparable project you solved and the primary tools you used.