Leboncoin

Leboncoin — recon plan (FR marketplace)

Not a social graph — a marketplace: the "nodes" are Ads and Sellers, the edges are seller↔listings, category/location facets, and messaging. Same recon method (find the API → auth from cookies → typed queries → playbooks).

Internal API: https://api.leboncoin.fr/... (the web app calls it directly):

• Search: POST https://api.leboncoin.fr/finder/search — JSON body with

filters (category, location {region/department/city}, keywords, price range, attributes), limit, offset, sort_by. Returns ads[] + facets.

• Ad detail: GET https://api.leboncoin.fr/api/adview/v1/public/

(or the listing page hydration) — price, description, images, attributes, seller.

• Seller: the seller's other listings (search by owner/user_id),

pro/private, ratings.

• Messaging: the conversation API (login required).

Auth (from the page)

• api_key header — a public web key Leboncoin's JS sends on every call

(capture from a request header).

• cookies ride same-origin, including the datadome cookie — Leboncoin is

behind DataDome anti-bot (like a WAF). Because we run in the REAL browsing session, the valid datadome cookie is already present → page-context fetch passes. (This is the gate, analogous to TikTok's signing.)

In-page fetch:

async body => {
  const r = await fetch("https://api.leboncoin.fr/finder/search", {
    method: "POST",
    headers: {
      "content-type": "application/json",
      api_key: "",
    },
    body: JSON.stringify(body),
  })
  return await r.json()
}

Entity model

Ad{ list_id, subject, body, price, category, location{city,zipcode,lat,lng}, images[], attributes[], owner:Seller, index_date } · Seller{ user_id, name, type: private|pro, siret?, no_of_ads, ratings? } · Category{ id, name }.

Recipes (read-first; writes gated)

• Search listings: finder/search with filters → ads (price, location,

seller).

• Ad detail: adview → full ad + seller + images.
• Seller's listings: search filtered by the owner/user_id → their inventory

(the "persona" of a seller = their listings + pricing + activity).

• Market scan / price graph: search a category+area → aggregate prices,

freshness, sellers → a market view (the marketplace analog of the social graph).

• Discovery → outreach: find matching ads → (gated) message the seller.

Capture method

Open leboncoin.fr, run a search/open an ad → list_network_requests for api.leboncoin.fr → read the endpoint, the JSON body shape, and the api_key header. Confirm the datadome cookie is set (else solve the challenge in the UI first).

Gotchas

• DataDome: bursts trigger a challenge/captcha. Keep volume low +

human-spaced; if a request 403s with a DataDome body, solve it once in the UI (the cookie refreshes) then resume.

• Body filter schema is nuanced (category ids, location objects) — capture a

real UI search's body and parameterize from it.

• Writes (message seller, post ad) need login + may add their own tokens —

capture live.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: agentproto
• Source: agentproto/ts
• License: Apache-2.0
• Homepage: https://agentproto.sh

Install and usage instructions live in the source repository linked above.