How to scrape Vinted in 2026 (complete guide)

Vinted has become a goldmine for anyone tracking the second-hand market: asking prices, trending brands, sought-after sizes, seller reputation. The catch is that the site is protected by DataDome, one of the strictest anti-bot systems around. A naive script gets blocked within a few requests. Here is what's collectible, why it's hard, and how to get the data cleanly.

What data you can collect on Vinted

Vinted's public pages hold plenty of information usable for price monitoring or market analysis:

• Listings: title, description, condition, photos, publication date.
• Prices: asking price, trends, ranges by brand and category.
• Attributes: brand, size, colour, material.
• Sellers: username, number of items, public ratings.

At scale, this lets you track a brand's value, spot underpriced items or measure how fast a category sells.

What blocks a naive scraper

Vinted relies on DataDome. A request sent with a plain HTTP client quickly hits a wall: truncated response, redirect to a verification page, or a CAPTCHA served by geo.captcha-delivery.com. DataDome doesn't check just one thing, it stacks signals:

• the IP reputation (a datacenter IP is immediately suspicious);
• the TLS handshake fingerprint, which betrays a script even when it pretends to be Chrome;
• the browser fingerprint and behaviour (mouse, scroll, pace).

A proxy only changes the IP. DataDome checks a dozen other signals: that's why a naive scraper, even behind a proxy, gets flagged.

For more, see our article on how anti-bot systems work and the one on TLS fingerprinting.

How to get the data cleanly

Getting past DataDome means making every signal line up: a real browser that runs the JavaScript, a coherent residential IP, and a fingerprint aligned end to end. That's exactly what WyndPath handles. You send the URL, WyndPath picks the route, gets past the protection and returns the page.

curl -G "https://api.wyndpath.com/v1/" \
  --data-urlencode "api_key=YOUR_KEY" \
  --data-urlencode "url=https://www.vinted.fr/catalog?search_text=nike" \
  --data-urlencode "render_js=1" \
  --data-urlencode "country=fr"

The render_js=1 parameter triggers a real browser (needed here), and country=fr makes the request exit from a French IP, to see the site like a local visitor. You only pay on success: a blocked request costs no credits.

Going further: get the JSON directly

Instead of parsing the page HTML, you can target the internal API Vinted uses to render its results. It returns already-structured data (title, price, currency, brand, seller…), far easier to work with than HTML:

curl -G "https://api.wyndpath.com/v1/" \
  --data-urlencode "api_key=YOUR_KEY" \
  --data-urlencode "url=https://www.vinted.fr/api/v2/catalog/items?search_text=nike&per_page=20"

This API normally requires a valid session (anti-bot cookies, anonymous token): without it, it returns an error. WyndPath establishes and maintains that session for you — it warms up the site, grabs the required tokens and replays them on the call, all from a coherent IP. You get the JSON as-is, without handling a single cookie.

The response is returned directly as application/json: on the client side, response.json() works with nothing to clean up.

import requests

r = requests.get("https://api.wyndpath.com/v1/", params={
    "api_key": "YOUR_KEY",
    "url": "https://www.vinted.fr/api/v2/catalog/items?search_text=nike&per_page=96",
})
for item in r.json()["items"]:
    print(item["title"], item["price"]["amount"], item["price"]["currency_code"])

The legal framework

Collecting public data is legal in France, but regulated. Vinted hosts personal data (usernames, sometimes more): the GDPR applies, with data minimisation and respect for robots.txt. The site's terms of use also matter, and a database can be protected by the sui generis right. We cover all of this in our article web scraping and the GDPR in France. In short: only collect what's useful to you, stay measured, and leave out sensitive data.