API abuse
Automated enumeration and scraping use the API exactly as designed, just relentlessly.
Every request is valid, authenticated and permitted. What is abnormal is the pattern: sequential identifiers, volume, timing, breadth. Since nothing is technically wrong, detection has to be behavioural, and the response is usually rate limiting and shaping rather than blocking.
Checked against the primary source.