Reverse-engineering the private Regal Cinemas API and building a showtimes bot

About a week ago, I pushed a script to my GitHub that would monitor the Regal Cinemas website for new movies and report it to a Telegram bot. It was decently feature-rich, but I still wasn’t fully satisfied with it. The primary issue I kept noticing was that the bot would properly fire off an alert whenever a new movie was posted to the website, but oftentimes tickets couldn’t be acquired yet because showtimes are updated separately.

This was obviously very frustrating, so I got to work trying to fix it. The biggest issue that I kept running into kept circling back to Selenium. I was scraping Regal’s website each time the script ran to find the new films listed on its homepage, and this was already a chore in its own right. It seems to use CloudFlare to block non-US IP addresses and also takes advantage of CloudFlare’s anti-crawler tech. Using requests would get blocked due to its user agent, but even passing a generic user agent (at the time of this writing, 41% of desktop users browse the internet on a Windows 10 machine running Chrome 126, represented as Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.3) wouldn’t work well due to the website using dynamic content. In circumstances like these, Selenium is usually the best bet, as it essentially runs a stripped-down version of a web browser to pull remote web content rather than trying to download it. This allows things like JavaScript to fully load in a page, where requests would pull static content.

However, due to its high resource usage, its usually better to avoid using Selenium if at all possible. Thankfully, Regal has left some information out in the open that makes accessing this information far easier.

Bazinga! Regal utilizes its own REST API at regmovies.com/api/ for pulling and pushing information from its own databases, and they seem to have left…pretty much everything about it exposed publicly. They even host their own website at developer.regmovies.com, which is pretty much a lightly reskinned default Azure API Management Developer Portal with no actual documentation on the API at all. I actually even signed up for the website to see if I could get any actual documentation, but even having an account yielded no actual documentation. The site does describe some sort of API limits, but thankfully, you don’t actually need to pass any API keys to use it, and there doesn’t seem to be any limits to its usage. So, here’s my own attempt at some documentation, after a couple of days of crawling and google dorking and the like.

Actually, before I go further, after some light brute-forcing, here’s a full list of Regal theaters and their codes, which you’ll find helpful with the API calls below.

And one final note, You need to pass a browser user agent for the API to work. Otherwise, it will fail.

localTheatreData

Main endpoint for pulling information about individual theatre locations.

Endpoint

1

GET regmovies.com/api/localTheatreData

Parameters

Response Fields

getShowtimes

Main API endpoint for fetching showtimes of a theater.

Endpoint

1

GET https://www.regmovies.com/api/getShowtimes

Parameters

Response Fields

shows Array

Film Array

Performances Array

movies Array

autoComplete

Main API endpoint for fetching geodata on a given ZIP code. This is utilized when a user is typing in their postal code to find the closest theaters to them when looking up showtimes.

Endpoint

GET https://www.regmovies.com/api/autoComplete

Parameters

Response Fields

Root Object

predictions Array

structured_formatting Object

terms Array

location Object

Miscellaneous endpoints

In my search, I also discovered the following endpoints, mostly associated with placing an order.

regmovies.com/api/Member
experience.regmovies.com/api/GetTicketsForSession
experience.regmovies.com/api/OrderMedia
experience.regmovies.com/api/GetTicketsForSession
experience.regmovies.com/api/ForceCancelOrder
experience.regmovies.com/api/GetOrder
experience.regmovies.com/api/AddTickets
experience.regmovies.com/api/cart
experience.regmovies.com/api/SeatPlan

They also varyingly take the following parameters:

• cartId, which is a string formatted as RWEB + 28 hex characters (presumably a Regal web token).
• VistaSession, a string consisting of 6 digits.
• sessionId, a string consisting of 6 digits.
• date, ISO 8601 format.
• theatreCode, a string for the unique 4-digit code of a Regal theatre.
• sessionToken, a string for a session token, stored locally as a cookie in UUID-4 format, AKA 32 hex characters separated in a 8-4-4-4-12 format. Can also pass false in some API calls that require it and still get a valid result. These API calls are absolutely ripe for exploitation, but I’ll leave that for another article after further analysis.

Conclusion

Getting back to the script that I was trying to write, after my discovery, I rewrote it from scratch to utilize Regal’s API and finally get back to using requests. This made the script run overall about 88% faster and use far less processing power. Real neat! Check it out on GitHub, or subscribe to the Telegram channel).