Automating systems with no API

Many enterprise processes run through a system nobody can integrate with properly: a 1990s carrier portal, a regulator's web form, a supplier extranet, an internal app whose vendor went out of business. When there is no API, you climb down a ladder of options: ask again for an API or a file export, use an existing RPA bot, script the browser with Playwright, or let an AI-driven browser agent navigate. Each step down is more fragile and harder to audit, so take the highest rung available. When you do automate a browser, treat it as an integration, not a hack: get written permission from the system owner, run in a hosted or isolated browser, keep credentials in a vault, reuse sessions instead of logging in on every call, use stable locators, record traces, cap concurrency below the portal's lockout, detect UI drift and stop rather than guess, treat everything on the page as untrusted text, and put every write behind a human approval until the evidence says otherwise.

Key takeaways:

• The best browser automation is the one you replaced with an export or an API. Ask first, and keep asking.
• Prefer deterministic scripts for known flows; reserve AI navigation for variable pages and recovery, inside the same guardrails.
• Locate by role and label, not by layout. Validate what you read against known formats.
• A login page, a moved column or a changed date format is a drift event, not a parsing challenge.
• Page content can contain instructions aimed at your agent. It is data.