Aditya's Blog

Hyperpersonal apps from HAR files

Published on

Hand a HAR file to an agent, describe the library you want, get back a typed Python client, a CLI, and a session-refresh loop. An hour or two, most of it the agent's.

These are sometimes called hyperpersonal apps. Market of one — software whose entire spec is "fits exactly how I work."

The disclaimer

Most services' Terms of Service forbid automated access of their private APIs. This is a technique for your own data on your own account. Past that, read the TOS — some services treat private-API scraping as account-bannable, a few as a CFAA matter.

Capturing the HAR

A HAR (HTTP Archive) is Chrome's export — every request and response the browser made in a recorded window, with headers, cookies, bodies, timing. JSON.

  1. Chrome DevTools → Network tab.
  2. Check Preserve log. Survives navigations.
  3. Filter to Fetch/XHR for a cleaner trace.
  4. Reproduce the action you care about.
  5. Right-click the panel → Save all as HAR with content.

Handing it to the agent

Drop the HAR somewhere the agent can read, then describe the surface you want:

Here's a HAR file from $service. Build me a Python library that exposes list_orders, place_order, and cancel_order as typed methods. Handle the auth flow you'll find in there. Generate a small CLI on top. Pydantic models for the responses. No tests against the live API without me approving the call first.

The agent reads the auth requests and builds the refresh loop. Strips browser headers to the minimum that matter. Names the endpoints, types the responses. Generates a CLI with reasonable subcommands.

The first pass is usually wrong about something — pagination shape, an optional header that turns out to be mandatory, an error path it didn't see in the capture. Tell it what broke. It fixes. Three or four rounds and the library works.

A few hundred lines of Python, scoped to exactly what you need.

Gotchas

The agent doesn't change the underlying API; these still apply.

Tokens expire. If the HAR didn't capture the auth flow, the agent can't rebuild it. Re-capture with login included.

Signed requests. Some services compute an HMAC in JavaScript before sending. The agent has to read the bundle and reproduce it. Hard mode, not always feasible.

WebSockets and SSE. Real-time data arrives over a socket the page opened on load. HAR captures the open, not the frames. DevTools has a separate Messages tab — that's where to look.

HAR is sensitive. Cookies, tokens, request bodies all in clear text. Don't paste one into a chat you don't control. Scrub Cookie, Authorization, and any postData.text before sharing.