In May 2026 Reddit deprecated its unauthenticated .json endpoints. If you had a script that appended .json to a URL and read the result — and thousands of people did, because it was the easiest public data source on the internet — it started returning 403.
Rather than repeat what other write-ups say, I tested every remaining public surface myself and recorded exactly what each one returns. Measurements below were taken on 7 September 2026, from a normal residential connection, logged out, with a browser user-agent.
What I measured
| Surface | Result | What you actually get |
|---|---|---|
www.reddit.com/r/{sub}.json |
403 | Nothing. An HTML error body |
www.reddit.com/r/{sub}/comments.json |
403 | Nothing |
www.reddit.com/user/{u}/about.json |
403 | Nothing |
oauth.reddit.com/... without a token |
403 | Nothing, as designed |
old.reddit.com/r/{sub}.json |
200 | ⚠️ 350 KB of HTML. Not JSON |
www.reddit.com/r/{sub}/.rss |
200 | 26 KB of real Atom XML, 25 items |
Three of those rows are worth more than the rest.
The trap: 200 with the wrong content
old.reddit.com still answers .json with HTTP 200. It is the only surface that looks alive if you check the status code.
It returns HTML. Three hundred and fifty kilobytes of it.
If your health check is if (res.ok), this endpoint passes. If your parser is wrapped in a try/catch that logs and continues, you will write empty rows on schedule and your dashboards will show a job running normally. Nothing errors. Nothing alerts.
This is the most expensive failure mode in scraping and it is worth naming precisely: the status code and the content are two different claims, and only one of them is being checked by most code. Assert on the shape of what came back — a required field present in a sample of every run — not on whether the request succeeded.
The survivor: RSS, and what it costs you
/.rss still works. It returned 25 items of genuine Atom XML with title, link, author, category, published, updated, content and id.
Now the part that decides whether it is useful to you. I checked the whole feed for metrics:
score ausente
ups ausente
num_comments ausente
upvote ausente
points ausente
The word "comments" does appear — inside post URLs (/r/programming/comments/1s9jkzi/...), as part of the path. It is not a count.
The RSS feed tells you what was posted. It cannot tell you what did well. No score, no comment count, no ranking signal of any kind.
For a lot of use cases that is fine — new-post alerting, keyword monitoring, filling a reading list. For anything that asks "is this gaining traction", it is not a substitute, and no amount of polling fixes it, because the number is simply not in the payload.
It is also rate limited harder than you would expect
I called /.rss five times in a row with a three-second gap. Every one returned 429.
The first call, minutes earlier, had returned 200 with full content. So the feed is real — it just runs out fast.
It recovered within about a minute, and then held: I checked again at 2, 5, 10 and 15 minutes after the block and every one returned 200 with the full 26 KB.
So the limit is a short, self-clearing burst cap rather than a penalty box — you are not locked out for the afternoon for asking twice. That is a usable limit if you poll one feed occasionally, and nowhere near enough to sweep a few hundred subreddits on a schedule. Measure it against your own volume before designing around it.
What replaced it, honestly
Authenticated OAuth access. This is the intended path. You register an app, get a token, and the API works. For personal-scale and non-commercial use, this is the answer and it is not especially painful.
Devvit, Reddit's developer platform, for things that run inside Reddit itself.
The commercial tier, if your use is commercial — and here I have to stop and be honest about what I could not verify.
What I could not confirm, and why
I could not confirm Reddit's commercial API pricing at the source.
reddit.com and redditinc.com both refuse automated requests from the tool I used, which is a fitting way to research this particular story. So I have no primary-source figure.
Secondary sources are freely available and they do not agree with each other. In a single search I found the commercial minimum reported as $12,000 per month and as $12,000 per year — a twelvefold difference — alongside "$0.24 per 1,000 calls", "50 million calls included" and "$50,000+ for enterprise". Most of those sources sell Reddit data, which is to say they are quoting the price of the alternative to themselves.
I am not going to launder any of those into a table and let the formatting imply I checked. What is safe to say: commercial access requires a negotiated agreement with Reddit's sales team rather than a credit card, and the entry point is high enough that it functions as a refusal for small builders. If you need the real number, ask Reddit, and treat anything you read on a vendor blog — including the range above — as unverified.
The May 2026 timing itself is well attested across many independent write-ups and matches what I measured. The precise announcement date I did not verify at the source.
If your scraper broke this week
In order, cheapest first:
- Check whether you were on
.jsonunauthenticated. If yes, that is your answer and no retry logic will fix it. - Check whether you "fixed" it by switching to
old.reddit.com. Look at what you actually stored since then. A 200 does not mean you got JSON, and you may have a week of empty rows. - Move to authenticated OAuth if your use case allows it. This is the supported path and it works.
- Consider RSS if you only need to know what was posted — and confirm your use case survives having no scores at all before you build on it.
- Price the commercial tier by asking Reddit directly, if you are commercial. Do not budget from a vendor blog.
The pattern underneath
Reddit in May 2026, X in February 2026 — priced per resource now, no free tier at all — Instagram with no public-profile route at any price. The specifics differ; the direction does not.
Public conversation data stopped being infrastructure and became inventory. Anything still open today is open until someone finishes metering it, and the archives nobody kept cannot be recovered afterwards, because the past was not photographed.
The route we picked is to collect from public pages ourselves, logged out, rather than through a reseller — designed and measured, and not yet running. The position and its trade-offs are on the social data page, including the parts that are uncomfortable. No social endpoint of ours is live yet, and that page says so instead of listing what does not exist.
All HTTP results above were measured on 7 September 2026 from a residential connection, logged out, with a browser user-agent — primary measurement, reproducible with curl. Reddit's commercial pricing is explicitly NOT confirmed and is flagged as such above. Platform behaviour changes; re-measure before you rely on any of it.