This is super interesting, especially the part about trying to reverse engineer their "security" measure. I did something like this a few months back for Paylocity, a time logging system that has a terrible web interface. After trying to talk with their sales people about them potentially offering an API, I was told "no API, just this mobile app." Turns out the mobile app is just an Ionic app with all of the resources (all, including tests and even test environment logins and stuff) baked in. Super easy to grab their API out of that (literally called /mobileapi/), but then the trouble was figuring out how they generated their security token header, which was also a little dance of timestamps and faked device info.

The best part was when I contacted them afterwards and warned them about the extra pieces of info they had baked in, their response was basically "yeah, we're aware that there's more in there than there should be, but it's not a priority." Oh well, they just have all of my personal information.