Trustpilot API vs Scraping: How to Get Review Data with Python

The Trustpilot API offers documented review access, but Business API access requires a business account with the API module. Public documentation does not mean anonymous or unrestricted access: start with the official prerequisites and your intended use.

This guide separates authenticated API integration from public-page extraction. Our quick run on October 17, 2026 tested the latter: three companies, six collected pages and 120 reviews. It is a small snapshot, not a benchmark or evidence of permission to collect or republish reviews.

What can the Trustpilot API do?

Business APIs support review collection, display and invitations; Data Solutions addresses a different access model. Choose the product before choosing an endpoint.

The Business API introduction describes operational integrations. Service reviews concern a business experience; the separate Product Reviews API handles product feedback. Sending an invitation is another operation, not a way to retrieve historical reviews.

Data Solutions documentation distinguishes Display access, which includes business details and latest reviews, from Insights access, which includes the service-review endpoint. Its latest-review endpoint returns up to five reviews (as of October 2026). Do not confuse Data Solutions Insights with an account’s review-analysis dashboards or assume their entitlements are interchangeable.

For competitor research, specify the companies, history, refresh frequency and intended output before requesting access. A technical endpoint description cannot establish your contractual rights.

How does the 4-step review access check work?

The 4-step review access check connects your purpose to an authorized retrieval route. Complete it before building a collector.

• Purpose: distinguish your own review operations, public display and competitor analysis.
• Entitlement: identify the agreement covering those companies and uses.
• Endpoint: match authentication, fields and pagination to the task.
• Permitted reuse: check storage, refresh, deletion and redistribution obligations.

How much does Trustpilot API access cost?

A free business account does not establish API entitlement. The official pricing comparison lists API access as an add-on for both Premium and Enterprise (as of October 2026).

Enterprise therefore should not be described as automatically including API access. The page does not publish a separate API add-on price; request a quote covering your domains and intended use. Do not substitute a base subscription price for the integration’s total cost.

Ask separately about Data Solutions access and any review-analysis subscription you need. Budget for engineering, synchronization and permitted storage as well as licensing: an inexpensive request is not necessarily an inexpensive integration.

How do you obtain a key and authenticate?

Confirm API-module access, create an application and use the authentication method specified for your endpoint. An API key and an OAuth access token serve different purposes.

The authentication guide links to application creation and identifies the API key as the Client ID. Public endpoints accept the apikey header; private endpoints require OAuth. Keep secrets on the backend and avoid credentials in URL query strings.

For OAuth, select the supported grant for your integration, inspect expires_in and follow that grant’s renewal procedure. Do not assume every grant returns a refresh token or mint a token for every request.

Discover the Business Unit ID, or BUID, through GET https://api.trustpilot.com/v1/business-units/find, using the domain lookup described in the public Business Units reference. Validate the returned business identity before saving that ID. Similar company names are a poor join key.

How do you retrieve reviews with Python?

For an authorized API integration, retrieve the correct business unit’s reviews, paginate deliberately and normalize records before exporting. We had no Business API key, so this API workflow is documentation-based and has no measured API responses.

The Business Units reference documents GET /v1/business-units/{businessUnitId}/reviews with API-key authentication, page, perPage and sorting parameters. That endpoint is limited to 100,000 records (as of October 2026); the documentation points larger retrievals to /all-reviews. Follow that endpoint’s own pagination contract rather than reusing assumptions.

In your Python integration, use explicit timeouts, validate each response and checkpoint successful pages. Deduplicate by review ID because newly arriving reviews can shift page boundaries. Keep the original timestamp alongside any reporting date you derive.

Define a CSV schema containing company identifier, review ID, rating, title, text, publication date and reply state. Select only necessary personal fields. Treat missing values separately from negative values, and never interpret a partially completed export as a complete history.

Product feedback uses /v1/product-reviews/business-units/{businessUnitId}/reviews; its endpoint reference documents page-based retrieval and product filters. Keep product identifiers separate from company identifiers.

The tested script below demonstrates public-page collection instead of an authenticated API call. Its output, trustpilot_reviews.csv, is the measurement artifact for our six-page collection.

How do you handle limits, errors and outages?

Cache authorized data, reuse valid tokens and retry only failures that may be temporary. Separate authentication problems from throttling and page challenges.

Trustpilot’s rate guidance recommends staying below 833 calls per five minutes and 10,000 per hour (as of October 2026). These are recommended ceilings, not guaranteed quotas. Serve dashboards from backend storage rather than making an upstream request for every visitor.

• Authentication failures: check credentials, grant and endpoint entitlement before retrying.
• Throttling: reduce concurrency and use bounded backoff, honoring a retry delay when returned.
• Server failures: retain checkpoints and consult the official status page.
• Unexpected HTML: inspect the response before attempting JSON parsing.

Our guides to Python retries and 403 errors explain these implementation patterns. Monitor schema changes, duplicate IDs, empty batches and stale refresh timestamps as well as HTTP status.

How do you integrate reviews into websites and dashboards?

Separate public presentation from internal analysis, and attach freshness information to both. Successful retrieval does not automatically authorize a custom display.

The Legal Brand Guidelines tie API use and custom widgets to subscription rights. They require accurate presentation and restrict third-party display. The Content Refresh Guidelines make copied content’s accuracy and freshness the content user’s responsibility.

For an authorized analytical dataset, chart star distributions, review volume and recurring complaint topics. Filter low-star reviews without replies to support follow-up. Label sentiment scores as model estimates and manually inspect examples before treating a keyword spike as a business finding.

Competitor alerts also need consistent windows and sufficient volume. A change in collection coverage can look like a rating decline. Record collection time, filters and failed pages alongside the metrics.

When should you use exports or third-party tools?

Use an account export when a permitted snapshot answers the question. Evaluate a collector only after checking its access rights, provenance and maintenance responsibilities.

The service-review export instructions direct users to Manage reviews, Service reviews, Inbox, then Export. Select a date range and download the CSV. The same instructions prohibit exporting reviews for display on other platforms.

That workflow is not evidence of competitor-export rights or product-review export eligibility. Confirm the exact dataset in your account before designing an import job. For external tools, request a sample schema, collection timestamps, deletion handling and a clear account of how the data was obtained.

When combining adjacent sources, keep provenance and rating scales separate. Our Google reviews guide and Amazon reviews guide cover those sources independently.

How does public-page scraping compare?

Public-page extraction worked after browser execution in our small run, but plain HTTP requests failed on both routes. This describes observed behavior, not durable access or contractual permission.

Our quick run on October 17, 2026 used Linux, Python 3.12, no login, no account cookies and no API key. We checked Amazon, eBay and Best Buy profiles with 3-5 second pauses and about 40 requests total, including diagnostics. The collection itself covered two pages per company on each route, producing the same 120 reviews.

The challenge loaded AWS WAF JavaScript, not a CAPTCHA. One of three residential browser attempts timed out after 46 seconds; its retry passed. Browser cookies and the matching User-Agent then worked with plain requests, including across residential exit changes in this run. That does not establish general cookie portability or diagnose every challenge signal.

The embedded __NEXT_DATA__ contained ratings, titles, text, publication and experience dates, country, verification and reply fields. A reviewer-name field existed but was excluded from the CSV. All 120 records were English; none was marked verified or had a company reply.

Pages 11 and 20 redirected to sign-in, while pages 1-10 loaded. At 20 reviews per page, the observed accessible window was about 200 reviews per company for that view. A larger JSON total count did not make the full history accessible.

The following is our tested trustpilot_scraper.py. Dependency installation follows the Playwright installation guide; request handling is documented in the Requests quickstart. Package versions were not recorded, so this is not a pinned reproducibility environment. Run collection only with appropriate permission.

"""Trustpilot public review pages -> CSV (no API key, no login).

Step 1: a headless browser opens one review page so the AWS WAF JavaScript
        check can run and set the aws-waf-token cookie.
Step 2: plain requests reuses that cookie + User-Agent to fetch pages 1..N
        and reads the review data from the embedded __NEXT_DATA__ JSON.

pip install requests playwright && playwright install chromium
"""
import csv, json, os, re, time
from urllib.parse import urlparse
import requests
from playwright.sync_api import sync_playwright

PROXY = os.environ.get("PROXY_URL")  # e.g. http://USER__cr.us:[email protected]:823
PROXIES = {"http": PROXY, "https": PROXY} if PROXY else None
COMPANIES = ["www.amazon.com", "www.ebay.com", "www.bestbuy.com"]
PAGES = 2            # without login Trustpilot serves pages 1-10 only
NEXT_DATA = re.compile(r'<script id="__NEXT_DATA__"[^>]*>(.*?)</script>', re.S)


def get_waf_cookie(url):
    """Let Chromium pass the JS check once, return its cookies and User-Agent."""
    proxy = None
    if PROXY:
        p = urlparse(PROXY)
        proxy = {"server": f"http://{p.hostname}:{p.port}",
                 "username": p.username, "password": p.password}
    with sync_playwright() as pw:
        browser = pw.chromium.launch(headless=True, args=["--no-sandbox"], proxy=proxy)
        context = browser.new_context(locale="en-US")
        page = context.new_page()
        page.goto(url, timeout=90000)
        page.wait_for_selector("script#__NEXT_DATA__", state="attached", timeout=45000)
        ua = page.evaluate("navigator.userAgent")
        cookies = {c["name"]: c["value"] for c in context.cookies()}
        browser.close()
    return cookies, ua


def fetch(session, url, retries=3):
    for attempt in range(1, retries + 1):
        r = session.get(url, proxies=PROXIES, timeout=40)
        if "/users/connect" in r.url:
            print(f"{url} -> login wall, stop")
            return None
        if r.status_code == 200 and "__NEXT_DATA__" in r.text:
            return r.text
        print(f"{url} -> HTTP {r.status_code}, retry {attempt}")
        time.sleep(5 * attempt)
    return None


def parse(html, company):
    props = json.loads(NEXT_DATA.search(html).group(1))["props"]["pageProps"]
    bu = props["businessUnit"]
    rows = []
    for rv in props["reviews"]:
        verification = (rv.get("labels") or {}).get("verification") or {}
        rows.append({
            "company": company,
            "trustscore": bu.get("trustScore"),
            "total_reviews": bu.get("numberOfReviews"),
            "review_id": rv["id"],
            "rating": rv.get("rating"),
            "published": rv["dates"]["publishedDate"][:10],
            "experienced": (rv["dates"].get("experiencedDate") or "")[:10],
            "title": rv.get("title"),
            "text": (rv.get("text") or "").replace("\n", " "),
            "country": rv["consumer"].get("countryCode"),
            "language": rv.get("language"),
            "verified": verification.get("isVerified"),
            "source": rv.get("source"),
            "has_reply": rv.get("reply") is not None,
            # rv["consumer"]["displayName"] exists too: personal data, not saved
        })
    return rows, props["filters"]["pagination"]


def main():
    cookies, ua = get_waf_cookie(f"https://www.trustpilot.com/review/{COMPANIES[0]}")
    session = requests.Session()
    session.headers.update({"User-Agent": ua, "Accept-Language": "en-US,en;q=0.9"})
    session.cookies.update(cookies)

    all_rows = []
    for company in COMPANIES:
        for n in range(1, PAGES + 1):
            html = fetch(session, f"https://www.trustpilot.com/review/{company}?page={n}")
            if not html:
                break
            rows, pg = parse(html, company)
            all_rows += rows
            print(f"{company} page {n}/{pg['totalPages']}: {len(rows)} reviews, {len(html)//1024} KB")
            time.sleep(4)

    with open("trustpilot_reviews.csv", "w", newline="", encoding="utf-8") as f:
        writer = csv.DictWriter(f, fieldnames=all_rows[0].keys())
        writer.writeheader()
        writer.writerows(all_rows)
    print(f"saved {len(all_rows)} reviews to trustpilot_reviews.csv")


if __name__ == "__main__":
    main()

The script assumes the observed schema and a nonempty result; an empty collection will fail at CSV field selection. Its browser also disables sandboxing, so keep this test isolated. Public-page markup can change independently of API contracts. See our Playwright guide for browser workflow context.

What legal and contractual restrictions apply?

Contract, crawler directives and law are separate checks. A successful response establishes none of the permissions needed for collection or reuse.

Trustpilot’s consumer terms require express permission for scraping, while its business terms prohibit scraping. Its enforcement policy describes blocking and possible legal proceedings. Inspect the applicable robots directives, but do not treat them as a license.

The 2022 hiQ v. LinkedIn opinion addressed public access under the CFAA in a preliminary-injunction dispute, not blanket scraping permission. EU database law can separately restrict substantial extraction and repeated systematic extraction.

The joint privacy-regulator statement confirms that publicly accessible personal information remains protected. Omitting names reduces exposure but does not anonymize review text automatically. Assess lawful basis, retention and deletion duties before collection. Our scraping legality guide adds context; the reader decides, check local law.

When can proxies help?

Proxies can change network routing for authorized collection. They cannot replace credentials, permissions or API quotas.

DataImpulse residential routing did not remove the initial challenge in our run. Browser execution was the relevant observed change, and residential browser access was slower in this tiny sample.

Measured HTML was 720-753 KB decoded and about 153 KB compressed on the wire. At $1 per GB, extrapolating to 1,000 pages gives roughly $0.15 compressed or $0.75 uncompressed, plus browser bootstrap traffic and retries. Fifty pages, or 1,000 reviews at the observed page size, would cost under one cent in compressed page traffic alone.

These are bandwidth estimates, not measured large-run bills or total project costs. DataImpulse is proxy transport, not a scraping API, managed unblocker, VPN or data vendor.

Test routing after confirming access

If your authorized workflow needs residential routing, consider a small DataImpulse trial with explicit request and bandwidth limits. Measure successful records, failures and total bytes before scaling; choose the API or account export when it better fits your task.

Last updated: October 17, 2026.