Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/tvw.py (Python)

Code before:

        app_js_code = self._get_js_code(video_id, webpage)

        try:
            api_key = self._search_regex(r'embedderAuth[\s]*:[\s]*{[^}]+vendorKey:\"(?P<token>\w+?)\"}',
                                         app_js_code, 'token')
        except RegexNotFoundError:
            self.report_warning('Failed to extract the API key. Falling back to a hardcoded key.')
            api_key = self.BACKUP_API_KEY

        client_id = self._html_search_meta('clientID', webpage)
        video_id = self._html_search_meta('eventID', webpage)

        try:
            headers = {'authorization': 'embedder', 'wsc-api-key': api_key}
            data = json.dumps({'clientID': client_id, 'eventID': video_id,
                               'showStreams': True}).encode('utf8')
            response = self._download_json('https://api.v3.invintus.com/v2/Event/getDetailed',
                                           video_id, headers=headers, data=data).get('data')
        except ExtractorError as e:
            if isinstance(e.cause, HTTPError):
                self.write_debug(e.cause)
                response = self._parse_json(e.cause.response.read().decode(), video_id).get('errors')
                if response.get('hasError') is True:
                    raise ExtractorError('{} said: {}'.format(self.IE_NAME, response.get('error')), expected=True)
            raise

        stream_url = traverse_obj(response, ('streamingURIs', 'main'))
        formats = self._extract_formats(response, video_id, stream_url)

        return {
            'id': video_id,
            'title': response.get('title') or self._og_search_title(webpage),
            'description': self._get_description(response) or self._og_search_description(webpage),
            'formats': formats,
            'thumbnail': response.get('videoThumbnail'),
            'subtitles': self.extract_subtitles(response),
            'timestamp': unified_timestamp(response.get('startDateTime')),
            'location': response.get('locationName'),
            'is_live': response.get('eventStatus') == 'live',
        }


Review comment (security):
I would just use the yt-dlp build in error handling. If there are specific cases you want to catch (geo restrictions, account requirements), you should set the `expected_status` parameter and then throw appropriate error messages based on the response.
```suggestion
        video_data = self._download_json(
            'https://api.v3.invintus.com/v2/Event/getDetailed', video_id,
            headers={
                'authorization': 'embedder',
                'wsc-api-key': '7WhiEBzijpritypp8bqcU7pfU9uicDR',
            },
            data=json.dumps({
                'clientID': client_id,
                'eventID': video_id,
                'showStreams': True,
            }).encode()).get('data')
```

Code after:
            headers={
                'authorization': 'embedder',
                'wsc-api-key': '7WhiEBzijpritypp8bqcU7pfU9uicDR',
            },
            data=json.dumps({
                'clientID': client_id,
                'eventID': video_id,
                'showStreams': True,
            }).encode())['data']

        formats = []
        subtitles = {}
        for stream_url in traverse_obj(video_data, ('streamingURIs', ..., {url_or_none})):
            fmts, subs = self._extract_m3u8_formats_and_subtitles(
                stream_url, video_id, 'mp4', m3u8_id='hls', fatal=False)
            formats.extend(fmts)
            self._merge_subtitles(subs, target=subtitles)
        if caption_url := traverse_obj(video_data, ('captionPath', {url_or_none})):
            subtitles.setdefault('en', []).append({'url': caption_url, 'ext': 'vtt'})

        return {
            'id': video_id,
            'display_id': display_id,
            'formats': formats,
            'subtitles': subtitles,
            'title': remove_end(self._og_search_title(webpage, default=None), ' - TVW'),
            'description': self._og_search_description(webpage, default=None),
            **traverse_obj(video_data, {
                'title': ('title', {str}),
                'description': ('description', {clean_html}),
                'categories': ('categories', ..., {str}),
                'thumbnail': ('videoThumbnail', {url_or_none}),
                'timestamp': ('startDateTime', {unified_timestamp}),
                'location': ('locationName', {str}),
                'is_live': ('eventStatus', {lambda x: x == 'live'}),
            }),
        }