TL;DR

  • Use a proxy for understanding; use reproducible requests for reporting.
  • Save raw requests and keep them minimal (strip noise, keep essentials).
  • Automate only after you understand the behavior.

My flow

  1. Intercept traffic in a proxy tool (manual exploration).
  2. Export a clean request and replay with curl/CLI.
  3. Turn it into an automated check only if it’s stable.

Repro request hygiene

  • Keep: Host, method, path, body, auth headers/cookies
  • Drop: analytics headers, random client hints, unstable IDs