Expedia Cars GraphQL Inspector: How I Turned Expedia's Network Traffic into Instant CSV Exports

Hamza — Wed, 01 Jul 2026 13:43:55 +0000

Inside Expedia's GraphQL: Building a Tool That Captures 700+ Car Rentals in 30 Seconds. Behind every modern website is an API conversation. Once you learn how to listen to it, everything changes.

By Hamza

I got tired of clicking "Load More."

You know the drill: you search for rental cars, the page shows 20 results, and there are 30 more pages hiding behind that little button. Click. Wait. Scroll. Click. Wait. Scroll. Your cursor finger starts hurting. Your soul starts dying.

So I built something better.

Expedia GraphQL Inspector v2.2 is a browser tool that intercepts Expedia's internal API calls, collects every rental car across every page in seconds, and dumps it into a CSV you can open in Excel. It runs in your browser — no Python, no Docker, no headless Chrome, no PhD in web scraping.

This is the story of how it works, piece by piece.

1. Fetch Interception — Catching Data Before It Renders

Every time you visit a modern website, your browser plays middleman. It sends requests to servers, gets back JSON blobs, and hands them to JavaScript that paints pixels on screen.

The trick? Get in the middle before the pixels happen.

The script monkey-patches window.fetch — the browser's built-in HTTP request function — and wraps it with a spy. Every single network request passes through this wrapper. The script inspects each one, asks "is this an Expedia car rental GraphQL query?", and if yes, clones the response JSON before the page ever sees it.

const originalFetch = window.fetch;
window.fetch = function (...args) {
  return originalFetch.apply(this, args).then(async (response) => {
    const cloned = response.clone();
    const json = await cloned.json();
    // Is this a car rental response? If so, save it.
    if (json?.data?.carSearchV3) {
      captureData(json);
    }
    return response;
  });
};

That's the entire foundation in ten lines. The original fetch still works normally — the page never even knows it's being watched. We just take a peek, copy what we need, and let the data flow through.

Why this beats scraping HTML: HTML is messy. It's designed for human eyes, not data extraction. Prices show up as formatted strings ("$123.45"), layout changes break your CSS selectors, and missing fields cause silent errors. Raw API data is pristine — typed, structured, complete. Why reconstruct what the server already sent perfectly?

2. GraphQL — One Endpoint to Rule Them All

If you've only ever worked with REST APIs, GraphQL looks weird at first. Instead of ten different URLs (one for users, one for products, one for search results), GraphQL uses a single endpoint with a query language.

Expedia's car search runs on a single GraphQL endpoint. Every request — first page, next page, sort by price, filter by supplier — hits the same URL with a different query payload inside the POST body.

The script doesn't care about URLs. It cares about operation name. Every GraphQL request has one — a human-readable label like CarSearchV3. The script filters for exactly that:

if (body && body.operationName === "CarSearchV3") {
  // This is the one we want
}

GraphQL responses have a predictable structure too: a data object, then nested edges and nodes, then the actual fields. Once you know the shape, you can walk it blindfolded.

{
  "data": {
    "carSearchV3": {
      "pageInfo": {
        "hasNextPage": true,
        "endCursor": "eyJsYXN0SWQiOjQwfQ=="
      },
      "edges": [
        {
          "node": {
            "vehicleId": "abc123",
            "supplier": { "name": "Enterprise" },
            "pricing": { "total": 245.00 }
          }
        }
      ]
    }
  }
}

One query, one shape, infinite cars. Beautiful.

3. Pagination — The Infinite Scroll Trap

Expedia doesn't send you 700 cars at once. That'd be too easy. It sends 25, plus a cursor — an opaque Base64 string that says "the next page starts here."

The page shows a "Show More" button. Click it, and the browser sends a new GraphQL query with the cursor from the previous response.

Manual pagination is torture. Auto-pagination is a solved problem:

Capture the first page's response
Read pageInfo.hasNextPage
Extract pageInfo.endCursor
Replay the same GraphQL query with the cursor injected into variables
Repeat until hasNextPage is false

There's a subtle bug to watch out for: duplicates. Sometimes the same car appears on multiple pages (Expedia's backend shuffles results). The script maintains a Set of vehicleId values and skips any node it's already seen. Deduplication with zero overhead.

4. Replay Requests — Acting Like a Human, Moving Like a Machine

The first page is captured from the user's real search. But what about page 2, 3, 4... 47?

The script replays requests programmatically. It takes the original GraphQL query payload, swaps out the cursor variable, and fires a fresh fetch call. Same endpoint, same headers, same authentication cookies (because the user's real browser session handles that), just a different cursor.

async function fetchPage(cursor) {
  const payload = {
    operationName: "CarSearchV3",
    variables: { 
      ...baseVariables,
      cursor: cursor || null
    },
    query: CAR_SEARCH_QUERY
  };

  const response = await fetch(GRAPHQL_URL, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(payload)
  });

  return response.json();
}

The magic is that the user's session is intact. No login tokens to manage. No cookies to rotate. The browser handles authentication automatically — the script just borrows the connection.

But there's a catch: you can't fire 50 requests instantly. Servers notice. So the script has three speed presets:

Speed	Delay	Rate
🐢 Slow	4s	Conservative, acts like a slow human
🐇 Medium	1.5s	Balanced, default setting
🚀 Fast	0.6s	Aggressive, for stable connections

Smart Retry: If a request fails (network glitch, server hiccup), the script waits and retries up to 3 times. Exponential backoff would be overkill — a simple 2-second retry window catches 99% of failures.

5. CSV Generation — From Nested JSON to Spreadsheet in One Click

GraphQL returns deeply nested JSON. A single car listing looks like:

{
  "node": {
    "vehicleId": "abc123",
    "supplier": { "name": "Enterprise", "rating": 4.2 },
    "vehicle": {
      "make": "Toyota", "model": "Corolla",
      "type": "Compact", "doors": 4,
      "transmission": "Automatic"
    },
    "pricing": {
      "total": 245.00,
      "currency": "USD",
      "dailyRate": 48.99,
      "fees": [
        { "name": "Airport Surcharge", "amount": 12.50 },
        { "name": "Insurance", "amount": 30.00 }
      ]
    },
    "pickup": { "date": "2026-07-15", "time": "10:00" },
    "dropoff": { "date": "2026-07-20", "time": "10:00" }
  }
}

Your boss doesn't want that. Your boss wants columns: Vehicle, Supplier, Total Price, Daily Rate, Pickup Date, Dropoff Date.

The script flattens this nested structure with a recursive extractor. It walks the JSON tree, follows known paths (defined in a field map), and builds a flat array of values.

const fieldMap = [
  ["vehicleId"],
  ["supplier", "name"],
  ["supplier", "rating"],
  ["vehicle", "make"],
  ["vehicle", "model"],
  ["pricing", "total"],
  ["pricing", "dailyRate"],
  ["pickup", "date"],
  ["dropoff", "date"]
];

Then it serializes to CSV using the standard RFC 4180 format — handles commas inside values, wraps strings in quotes, escapes double quotes. No library needed, just careful string building.

The download happens via a classic browser trick:

const blob = new Blob([csvContent], { type: "text/csv" });
const url = URL.createObjectURL(blob);
const a = document.createElement("a");
a.href = url;
a.download = `expedia-cars-${Date.now()}.csv`;
a.click();
URL.revokeObjectURL(url);

No server involved. The CSV is generated entirely in the browser and downloaded instantly. Private data never touches a third party.

Putting It All Together: The 30-Second Workflow

Search for cars on Expedia like you normally would
The script starts capturing automatically — you see a counter tick up
Click ↻ Auto (the gold button) — the progress bar appears
Watch it fly through 30+ pages in about 30 seconds
A CSV downloads automatically — 700+ cars, structured, ready

That's the difference between tapping the source directly vs. scraping rendered HTML. 30 seconds vs. 15 minutes. No Python setup, no Playwright config, no CAPTCHA headaches.

What I Learned Building This

Fetch interception is absurdly powerful. A dozen lines of monkey-patching gives you visibility into everything a website does. It's like having X-ray vision for network requests.

GraphQL makes scraping easier, not harder. One query shape, transparent variable passing, and deterministic responses. If you understand the one query, you understand the whole API.

Pagination is the bottleneck. Almost every "scraper that's too slow" problem traces back to inefficient pagination. Nail the pagination, and you nail the speed.

Replay with real sessions is king. No proxies, no auth tokens, no session management. The user's browser handles all of that. You just borrow the connection.

CSV is still the universal format. JSON is for machines. CSV is for humans with Excel. Don't overthink it — flatten, serialize, download.

The full source code is available on GitHub. Free, open-source, MIT licensed. Built by me (Hamza), powered by curiosity and an allergy to repetitive clicking.
Youtube link

Expedia GraphQL Inspector v2.2 — because your time is worth more than clicking "Load More" 47 times.

DEV Community: Hamza