Lesson learned, they regularly do this if you have a website that one of their crawlers hit as active. If you really care about it check in about a year later, chances are if you havent inquired within a year they’ll release the domain and you can pay normal sale price for it
also keep in mind for people not on windows, namecheaps API only functions for business grade, and also is not clearly documented, there is a “dynamic dns setup page” but it isn’t up to date. I find myself trying to use openwrt’s DDNS pages for it but it still isn’t accurate, I am likely going to transfer elsewhere when im closer to the end of my lease. This API restriction also prevents you from easily automating your SSL process using letsencrypt as you are locked down to subdomain based entries instead of wildcard domains.