i replay the endpoint from a fresh client and change one thing at a time, like the ip, the tls fingerprint, or the cookies, to see what they actually check

if all that's missing is auth you can legitimately get, the contract is basically just auth. if it also needs a runtime generated bot check, it's probably tied to the browser

for flows already in a browser i'd run a network version alongside for a week before switching and keep schema checks after, since passing the replay doesn't mean it stays stable