Address API error [406]

Hi again,

Thanks for all your hard work keeping this project alive. Big shoutout to you guys who keep it going, love your work

I believe the program is broken again.

Over the last few days I've been getting this error message address {"error":"address API returned status code: 401"}
When I try using the 500 Queen Street example in the Readme, it seems to be returning HTML for the webpage

I wish I could help more but I don't know what I'm doing. Would it be possible to give me some headers on how I can assist for any future errors?

Thanks

Thanks for the report. I reproduced this on 2026-05-21 with the current address endpoint:

GET https://experience.aucklandcouncil.govt.nz/nextapi/property?query=500%20Queen%20Street&pageSize=10

The response is 401 Unauthorized with:

{"error":"Authorisation error. Current IP address logged."}

I also checked the current Auckland Council collection-day frontend. It still calls /nextapi/property, but it now attaches Authorization: Bearer <session token> from a SessionTokenProvider. The existing aklapi request only sends browser-style headers, so the upstream API now rejects it before address matching happens.

Next step is to add a token acquisition/refresh path before calling /nextapi/property, or find a supported public address lookup endpoint that does not require the frontend session token. For future reports, the most useful details are: the address queried, endpoint used (/api/v1/addr, /api/v1/rr, or /api/v1/rrext), the exact JSON error body, and the approximate time the request failed.

Hello,

Thanks for your prompt response and efforts!!! Almost missed my rubbish collection this week since the notification didn't work 😂

In the hopes of helping, with my limited homelabbing knowledge and ALOT of googling, I think I've figured out a few things.

Checking the network tab of Chrome Dev tools, I see that the webpage still pings
Request URL https://experience.aucklandcouncil.govt.nz/nextapi/property?query=500%20queen%20street&pageSize=10
so that hasn't changed like you mentioned.

I also see the new Authorization header you mentioned

Bearer eyJhbGciOiJIUzI1NiJ9.eyJzZXNzaW9uSWQiOiJhNmJmZTE2Mi0yY2NlLTRiOTgtOGVhMy01Mzc0OWQwMWI5MGMiLCJleHAiOjE3Nzk0NjM4MDN9.IDIhB1B-YpCE4y-r7y8WCL_niisbqDgpoFWSxm1dRrY

Since it starts with eyJ, its a JWT token(?) and decoding it revealed it has a TTL of 15 minutes. So that means we can't just hardcode it into the app.

I noticed that there isnt any call out in the network tab to an auth url anywhere. So I'm guessing that when you load up the webpage, the server issues you a session ID and a JWT token? I searched for my token and it comes up in the html for the webpage in the script section so its a JS server action and is loaded as soon as the webpage loads?

<script>
            self.__next_f.push([1, "5:[\"$\",\"$L19\",null,{\"initialToken\":\"eyJhbGciOiJIUzI1NiJ9.eyJzZXNzaW9uSWQiOiIzOD.....

So I'm guessing that if we curl the webpage and filter out this section of the HTML, we'd be able to get a auth token everytime?

I don't know what to do next or how to go about it but I hope that helps and I'm not just waffling 😂

Missing the collection is "not ideal", as one of my friends would say.

Thanks for reverse engineering effort, that's helpful. Yes, that's the general plan - get the initial token, then remember it at least for the duration of the session, or even cache it somewhere for its TTL — that would save 1 round trip per TTL :) ain't much but honest work.jpg

Status update from the Issue 32 fix work:

Implemented and verified the address API part of the fix.

What changed:

Confirmed the current Auckland Council collection-day landing page embeds an initialToken in the Next/Flight payload.
Added a small cached token provider that fetches that page at runtime, extracts the token, decodes JWT expiry when possible, and falls back to a short TTL otherwise.
Wired address lookup requests to send Authorization: Bearer <runtime token>.
Improved non-200 address API errors with bounded, sanitized upstream response snippets.

Verification:

go build -v ./...
go test ./...
PORT=18080 go run ./cmd/aklapi
curl 'http://localhost:18080/api/v1/addr?addr=500%20Queen%20Street'

Result for /api/v1/addr:

{"items":[{"id":"12342478585","address":"500 Queen Street, Auckland Central"}]}

Remaining limitation:

/api/v1/rr and /api/v1/rrext now get past address lookup, but the Auckland Council collection-detail page returns 406 for the selected address page. A real browser HAR of the same workflow shows the same thing: address search calls return 200, then the collection-detail request for the selected property returns 406. So the original address 401 is fixed, but rubbish collection detail is currently blocked by upstream behavior outside the token fix.

No captured bearer token, cookie, HAR payload, or private secret is included here or committed.

The only caveat that aucklandcouncil.govt.nz website and the rubbish page in particular returns 406 in my current location, so I'm only able to test the address API and it works. I submitted the PR #33 , — you asked if you could help, if that still stands — I'd really appreciate if you could you check it out and test it locally to confirm that the rest endpoints also work, because I can't ¯\_(ツ)_/¯ Once confirmed, I'll merge it. Thank you!

I came across this project due to getting 406 errors in my browser when using the AKLC website - I have a feeling this is due to my public IP being rate limited due to too much scraping via Home Assistant.

I tried running your docker container with the Queen Street example but I'm getting a 401 error too :(

@benjani85

@benjani85 good that you asked, I had a PR open which I forgot about. It's merged now, I tagged version v1.4.4, it should build shortly and be pushed to the docker hub.

@rusq

@rusq thanks for providing an updated version for everyone. Does it take long to build? I still don't see 1.4.4 available on docker hub.

@benjani85

@benjani85 I forgot that there's no auto-release on this repository, published manually now, should be available in a minute for pulling from docker hub.

Thanks, it's available now. Sadly I'm still getting a 406 error however my assumption is that is due to my public IP being prevented from scraping. Are you able to test from your side just to confirm the issue is my side?

Doesn't work now. I have confirmed it before releasing - was working, now getting 406. Can't even access it manually.

I am also getting the 406 error both through the API and trying to look it up manually. If i go onto mobile data I can lookup my bin days with no 406 error. Is Auckland Council blocking IPs?

UPDATE: Yes I have heard directly from an IT rep at Auckland Council they are blocking IPs that do this. They have also just updated their website terms and conditions with the following section:

Restrictions

You may access and use our website only in accordance with these terms and conditions. We may restrict access to our website for individuals or organisations who:

access our website from an IP address we consider to be malicious (including via Tor or a virtual private network)

access our website in a manner that is unlawful or unauthorised

access our website from a country we have blocked.

You must not use automated tools, such as bots or web scrapers, to access our website unless you:

operate a public search engine and comply with Auckland Council’s robots.txt file , or

have prior written permission from Auckland Council.

We reserve the right to monitor, manage, restrict, suspend or block access to our website where reasonably necessary. If we detect excessive or abusive activity, we may take action to stop it. This includes stopping activity involving automated tools that disrupt our services or breach these terms and conditions.

They did say in their email there is a job in their backlog to create an API for this data to be made available and they expect it to be complete in 2027 sometime but did not give a firm time frame.

Quote: "Unfortunately, you are blocked for the reasons you stated above. We have a work item in our backlog to develop a public API for information such as rubbish, recycling and food scraps collection dates, but this will not be worked on until 2027. "

@Gruthius

@Gruthius thanks for that! Why not just allow the scraping of rubbish data while they figure out the public API. Probably won't be free either. RIP.

Thought it's worth trying: sent an email asking to consider liberating the data access to this particular section of the website.

Navigation Menu

Repository navigation

Address API error [406] #32

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Address API error [406] #32

Description

Activity

rusq commented on May 21, 2026

SkillzWhoKillz commented on May 22, 2026

rusq commented on May 22, 2026

rusq commented on May 23, 2026

rusq commented on May 23, 2026

benjani85 commented on Jul 1, 2026

rusq commented on Jul 1, 2026

benjani85 commented on Jul 2, 2026

rusq commented on Jul 4, 2026

benjani85 commented on Jul 4, 2026

rusq commented on Jul 13, 2026

Gruthius commented on Oct 8, 2026

rusq commented on Oct 24, 2026

rusq commented on Oct 24, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions