We had a similar governmentally organized system in our country during the first vaccination round where people could book an appointment. The website fell over

We had a similar governmentally organized system in our country during the first vaccination round where people could book an appointment. The website fell over and the devs introduced a queuing system and had you waiting in line. Except that it was badly implemented and only enforced client-side (through JavaScript) and hence very easy to circumpass. It also had a similar API which could be polled to see when a slot freed up. This actually happens quite often. As another example, there is a particular country visa centre which requires you to make an appointment and is typically fully booked for weeks on end. The calendar info is loaded in through an API call and the selected date then form POSTed with a hidden field's value set to an identifier representing the date and time. Not in plaintext, but easy enough so that it can be guessed. Once you spoof the value, no further server-side validation happens and no one at the centre will check it. I wanted to book a restaurant a couple of weeks ago. As I was discussing options with a friend, the booking provider already forced a refresh and our desired time slot was gone. Again, taking a look in the Network tab of the browser and spoofing a value led to a confirmation at the desired time. I expected a call saying that they were overbooked, though strangely enough the place was not packed (I guess they kept some tables open for social distancing / walk-ins / phone reservations). This is really security 101 on the same level as SQL injection. Strange how every dev seems to know how to hook up something to an API but still makes the same mistakes.