No public API? Build one. Four layers, one of them disposable.

import json, os, tempfile

# You logged in with a real browser. These are the cookies that ride on the
# XHR you found in the Network tab -- the auth the endpoint actually checks.
# (In Ray's stack a CDP bootstrap reads these straight from the live tab via
# Storage.getCookies, so HttpOnly cookies are visible. Shown here as a literal
# so the shape is obvious.)
captured = {
    "session_id": "PASTE_FROM_DEVTOOLS",   # the long-lived auth cookie
    "csrf_token": "PASTE_FROM_DEVTOOLS",    # rotates; we re-read it per response later
}

SESSION_PATH = "sessions/example.json"

def save_atomic(path, data):
    """tmp + os.replace so a crash mid-write never corrupts a good session."""
    os.makedirs(os.path.dirname(path), exist_ok=True)
    # Reject empty cookies now: an empty string passes `if cookie:` but 403s
    # every later request with a cryptic auth error.
    for k, v in data.items():
        if not v or not isinstance(v, str):
            raise ValueError("cookie " + k + " is empty -- re-capture, do not save")
    fd, tmp = tempfile.mkstemp(dir=os.path.dirname(path), suffix=".tmp")
    with os.fdopen(fd, "w") as f:
        json.dump(data, f)
    os.replace(tmp, path)   # atomic on the same filesystem

if __name__ == "__main__":
    save_atomic(SESSION_PATH, captured)
    print("saved " + str(len(captured)) + " cookies -> " + SESSION_PATH)

import json
from curl_cffi import requests   # pip install curl_cffi

ENDPOINT = "https://example.com/api/notes"   # the XHR you captured in step 1

def load_session(path="sessions/example.json"):
    with open(path) as f:
        return json.load(f)

def make_session():
    saved = load_session()
    # impersonate="chrome120" -> Chrome's real TLS fingerprint, not python's.
    # A plain requests/httpx fingerprint gets blocked; this gets through.
    s = requests.Session(impersonate="chrome120")
    s.cookies.update(saved)
    # Realistic headers still matter -- curl_cffi only fixes the transport.
    s.headers.update({
        "Accept": "application/json",
        "X-Csrf-Token": saved["csrf_token"],
        "Sec-Fetch-Site": "same-origin",
    })
    return s

def fetch_notes():
    s = make_session()
    r = s.get(ENDPOINT)
    r.raise_for_status()
    return r.json()

if __name__ == "__main__":
    print(fetch_notes())

from dataclasses import dataclass
from curl_cffi.requests.errors import RequestsError
import client   # step 2

@dataclass
class NotesResult:
    notes: list | None = None
    error: str = ""
    error_kind: str = ""        # auth_expired | rate_limit | transient
    @property
    def ok(self):
        return self.error_kind == "" and self.notes is not None

def get_notes():
    """Typed verb. The agent calls this -- never the raw HTTP."""
    try:
        s = client.make_session()
        r = s.get(client.ENDPOINT)
        if r.status_code == 401:
            return NotesResult(error="session rejected", error_kind="auth_expired")
        if r.status_code == 429:
            return NotesResult(error="rate limited", error_kind="rate_limit")
        if r.status_code >= 400:
            return NotesResult(error="http " + str(r.status_code), error_kind="transient")
        return NotesResult(notes=r.json())
    except (RequestsError, ValueError) as e:
        # never let a raw secret-bearing body into the message
        return NotesResult(error=type(e).__name__, error_kind="transient")

import argparse, json
from verb import get_notes

p = argparse.ArgumentParser()
p.add_argument("action", choices=["notes"])
args = p.parse_args()

r = get_notes()
print(json.dumps({"ok": r.ok, "error_kind": r.error_kind, "notes": r.notes}, indent=2))