[Bug]: nba_api.live silently swallows 403s and raises a misleading JSONDecodeError

[jaredalonzo]

NBA API Version

1.11.4

Issue

When cdn.nba.com rejects a request with a 403, nba_api.live attempts to JSON-parse the HTML error page and raises JSONDecodeError: Expecting value: line 1 column 1 (char0). The actual HTTP status code and response body are never surfaced. From the caller's perspective, it looks like a malformed JSON response rather than an access-denied error.

Steps to reproduce

from nba_api.live.nba.endpoints.scoreboard import ScoreBoard
ScoreBoard().get_dict()
# raises: JSONDecodeError: Expecting value: line 1 column 1 (char 0)

The real response is HTTP 403 with an HTML "Access Denied" page from the CDN's WAF.

Root cause

The live HTTP client calls json.loads() on the response body without first checking response.status_code. Any non-JSON response — including HTML error pages — produces a confusing parse error.

Relationship to PR #671

PR #671 (#671) fixes the immediate cause of the 403 by adding a Referer header. Testing confirms Referer alone is sufficient to get through the CDN currently. This issue is about a separate problem: even with the header fix merged, if the CDN ever rejects a request again for any reason, the caller will still get a JSONDecodeError with no indication of what actually went wrong.

Suggested fix

Check the HTTP status code before attempting to decode, and raise a descriptive error if it's non-200:

resp = session.get(url, headers=headers, timeout=timeout)
if resp.status_code != 200:
    raise NBALiveError(
        f"HTTP {resp.status_code} from {url}: {resp.text[:200]!r}"
    )
return resp.json()

This makes the 403 visible on first inspection rather than requiring the caller to dig through a misleading stack trace to find it.

Code

from nba_api.live.nba.endpoints.scoreboard import ScoreBoard
ScoreBoard().get_dict()
# raises: JSONDecodeError: Expecting value: line 1 column 1 (char 0)

[ltzmax]

Well The NBA blocked it for now or changed their route url again, which needs an new update, i currently dont see any new url update on their websites but assume it will start coming closer to new matches... the URL is an undocumented, private API meant only for their official website and app frontend, not for public developer use. They frequently update their anti-scraping measures to stop third-party bots and libraries (like nba_api) from hammering their servers and services.

edit: though yes, that pr would ngl fix the issue as a temp fix, but nba will still continue to block or and update their scraping measures.