How websites deliver their data: 34 read recipes by mechanism
Of the 34 no-login read recipes in Wield's registry, 15 call a site's JSON endpoint and 8 read JSON embedded in the HTML page. Nine read server-rendered HTML with selectors. The last two use GraphQL persisted queries and a turbo-stream data loader. The registry holds 41 recipes on 29 sites. The classification is editorial and as of 7 Nov 2026.
Key finding
Most read recipes use JSON, either from an endpoint or embedded in the page: 23 of 34. The benchmark sample is too small to show whether the delivery method predicts blocking. The one GraphQL task, zalando.de, was blocked in every agent run, and Wield passed 0 of 9 runs there.
The five delivery mechanisms
- JSON API. The site's own frontend calls a JSON endpoint, and the recipe replays that call. Examples: flixbus.de, chefkoch.de, MVG and YouTube.
- Server-rendered HTML. The recipe reads result cards from the HTML with CSS selectors.
- JSON embedded in the page. The data sits inside the HTML. Examples: a
__NEXT_DATA__script on autoscout24.de, walmart.com, willhaben.at and zillow.com; a data script on airbnb.com; the Apollo cache on booking.com; island props on kleinanzeigen.de; and a window variables script on opentable.com. - GraphQL (persisted queries). zalando.de. Query hashes change with site deploys.
- Framework data endpoint (turbo-stream). check24.de's loader returns about 200 electricity tariffs in one GET.
These are the sites' own undocumented frontend endpoints. None is a public API.
Which recipes use which
| Delivery method | Read recipes (of 34) | Recipes |
|---|---|---|
| JSON API | 15 | arbeitsagentur.de, bahn.de, chefkoch.de, doctolib.de (get-slots, search-practitioners), eventim.de, flixbus.de, ikea.com (check-stock, search-products), immobilienscout24.de, jameda.de get-slots, lieferando.de, mvg.de (two recipes), youtube.com |
| Server-rendered HTML | 9 | amazon.com, ebay.de, idealo.de, jameda.de search-doctors, mobile.de, otto.de, stepstone.de, vinted.de, zalando.de (HTML fallback) |
| JSON embedded in the page | 8 | airbnb.com, autoscout24.de, booking.com, kleinanzeigen.de, opentable.com, walmart.com, willhaben.at, zillow.com |
| GraphQL (persisted queries) | 1 | zalando.de |
| Framework data endpoint (turbo-stream) | 1 | check24.de |
Some recipes mix methods. doctolib.de search-practitioners calls a JSON API but needs an object cut from the server-rendered page. jameda.de get-slots needs a token embedded in an inline script. idealo.de combines a JSON suggest call with product-page HTML. immobilienscout24.de's JSON needs a public key read from the page.
Does the mechanism predict being blocked?
Not in this sample. The table cross-tabs the 23 benchmark tasks by mechanism.
| Delivery method | Benchmarked tasks | Tasks where every agent run was blocked | Wield runs passing |
|---|---|---|---|
| JSON API | 9 | 4 | 71 of 73 |
| JSON embedded in the page | 7 | 3 | 62 of 63 |
| Server-rendered HTML | 5 | 2 | 41 of 45 |
| Framework data endpoint (turbo-stream) | 1 | 0 | 9 of 9 |
| GraphQL (persisted queries) | 1 | 1 | 0 of 9 |
Each group holds 1 to 9 tasks, which is too few to show a pattern. Read the table as a description, not as evidence that one method is safer.
Method and caveats
- Each of the 34 no-login read recipes gets one primary mechanism from its provenance notes. Mixed cases are noted above.
- The mechanism is an editorial classification. It does not describe how a site is built inside.
- Reaching a site's endpoint this way does not mean the site allows automated access. Check the terms notes for each site in the registry.
- The registry holds 41 recipes on 29 sites: 34 read without login, 5 read with login (untested) and 2 write (untested).
- Benchmark basis: 23 tasks on 21 sites. Zalando's HTML fallback is excluded. The benchmark is still running.
FAQ
Do most websites have a JSON API behind the page?
Not the web as a whole. In Wield's registry, 23 of 34 no-login read recipes call JSON, either from an endpoint or embedded in the page. The registry reflects the search pages Wield built first, so it does not measure the web at large.
What is __NEXT_DATA__?
It is a script tag on pages built with Next.js that holds the data the page renders, as JSON. Wield's recipes for autoscout24.de, walmart.com, willhaben.at and zillow.com read it from the HTML instead of loading cards.
Does the delivery mechanism decide whether a bot is blocked?
Not in this data. The agent was blocked in every run on 4 of 9 JSON API tasks, 3 of 7 tasks with embedded JSON, and 2 of 5 HTML tasks. The one GraphQL task was blocked in every run. These groups are too small for a conclusion.