If you're just pinging the endpoint without providing the necessary header then you are effectively a bot in this case. If you go through the motions to fill out the form and then submit it you're at least not explicitly telling the service you are going against its wishes by pinging the API directly.
As for the challenge, that seems to be within Cloudflare's implementation which then returns the token to submit with the form. HIBP then verifies the token to make sure its a match before checking for the data and sending a response.
If the service even provides such header or 429 status code at that. They could provide the 418 status code for fun. In this case – without checking the form implementation – I can assume that it provides a JSON response rather than a text response meant to be thrown into the DOM. Grabbing data from JSON is naturally easier but you could use a DOMParser for text content itself if it's sufficiently consistent.
The other thing about "waiting" is that bots may not want to do that, or maybe some sort of deadline is sooner than such waiting would allow.
To me, requiring a unique key to be input with the search, that is created after X amount of time (both provided by the initial response and increasing exponentially for subsequent requests) seems like it could be sufficient. If the next request is sooner than X then block them for Y amount of time for attempting to bypass allowable behavior. Allow like 5-10 emails then implement the wait-based functionality so that most non-bots would be fine. After all we're talking about blocking an endpoint only ever meant to be used via the website by actual users, typically they are not trying to check thousands of emails super fast.
The LG 43UN700-B was a good choice for me and I would like 2 more for my workstation. Currently I have that with four 22" FHD monitors all connected via USB adapters to a laptop from 2014. Being ADHD and running 8 screens for my (currently) freelance web development work is great as it allows me to stay focused on things and be efficient with my time.
That said, I am in need of an upgraded computer...
Edit: I forgot to mention that it can be split up to 4 separate FHD screens like I currently have it (for easy window snapping), with 4 separate inputs if you want.
I will likely always advocate for Shopify as long as they continue to strive to make commerce better for everyone.
As a developer, hosted Shopify is extremely powerful and enables the ability for merchants to create awesome personalized commerce experiences for their customers.
Shopify is great and if you want to start selling in minutes (literally) or do not have complex back-end requirements I highly recommend you use it. (In fact, I believe they have a sale on their plans as of the time of this comment in case you are interested in checking it out.)
As for the challenge, that seems to be within Cloudflare's implementation which then returns the token to submit with the form. HIBP then verifies the token to make sure its a match before checking for the data and sending a response.