Mostly recording and replaying the network request logs through Chrome and comparing diffs as I clicked around, looking at headers and URL params generated from clicking to get a high level picture for how it all fit together.

They didn’t do anything fancy in terms of auth, etc, so the only thing that was challenging was guessing some additional parameters and formats for things like number of nights, etc., once I had the basic structure.

Once I had a basic search working, the rest of it was pretty straightforward. It works for other hotels that use this booking software as well, but I didn’t bother to go down that rabbit hole much further as I didn’t want to encourage adversarial techniques and I only need to use it a few times a year.

My guess is the developer tools. Maybe the web page makes you open a date dropdown for "check-in" > select check-in date, same for checkout, hit "search", and then a pop-up would open saying "sorry, nothing available", which you'd have to dismiss before repeating the process, but in the developer tools you might be a able to see that there's an XHR query which is just something like /searchAvailability?checkIn=20230313&checkOut=20230315/&guests=2, and OP's script could just modify the dates and hit this request URL.

REST APIs can be queried easily enough with curl or a gui like Postman. The more impressive bit is working out the API interface.