Recently I am using CloudFlare for one of my server. We give XML API support for one of our product. When any developer is trying to get their Order Details though our Shopping Cart API recently, somehow in the XML, all emails are scrapped.  Even I have found that, some additional javascript is added in the API result of XML dataset that we were not adding our API codebase.

It tooks a lot of time to figure out finally that, it is not us, it is cloudflare who does it if you set (or set as default) something called Email Address Obfuscation.
This section can be found at Scrape Shield >> Email Address Obfuscation >> Turn to Off. Now your developer will find the exact API that you are sending.