They probably use a combination of the API and raw server requests due to how easy it would be otherwise to spoof viewership for ad revenue fraud. Would not surprise me anyway.