Akamai Sensor Data
Generate the payload. Submit the sensor yourself. This task produces a sensor payload for the page's Akamai collector. Capture the collector endpoint when specifying it, then post the payload in the original browser session.
{
"clientKey": "capzy_YOUR_API_KEY",
"task": {
"type": "AkamaiSensorData",
"websiteURL": "https://www.example.com/"
}
}Illustrative values. Replace the inputs with values from your current integration.
Locate the sensor collector.
This task produces a sensor payload for the page's Akamai collector. Capture the collector endpoint when specifying it, then post the payload in the original browser session.
Your API key authenticates Capzy.
Provider keys, challenge IDs, images, and session values belong inside task.
Inspect the page's telemetry POST.
- Open Network, load the protected page, and filter for the Akamai/bmak telemetry request.
- Copy the parent page into websiteURL. When supplying endpoint, copy the telemetry POST's full Request URL, including path and query.
- Read the request's User-Agent if your integration supplies a specific one. Keep the current cookie jar and solving proxy available.
{
"websiteURL": "https://example.com/account",
"endpoint": "https://example.com/YOUR_SENSOR_COLLECTOR"
}websiteURL is the protected page. endpoint is its sensor receiver; copying one into the other changes the task context.
How Akamai Sensor Data works
Akamai Bot Manager's web/desktop variant validates a session by collecting 100+ browser signals through an obfuscated JS bundle (`bmak`) and POSTing them as a `sensor_data` string to a rotating telemetry endpoint, which updates the `_abck` / `bm_sz` cookies. This product returns just that `sensor_data` payload. You supply the page that loads bmak (and optionally the telemetry endpoint you captured); we run the site's OWN bmak in a real-Chrome sandbox under a captured device profile and hand back a valid, well-formed `sensor_data` string for you to submit from your own session. Use this when you already manage your own Akamai session (cookies, IP, submission) and only need the hard part — a coherent sensor. If instead you want us to mint the full validated `_abck` cookie family, use Akamai Web at /solvers/akamai-web; if you're replaying a native mobile app, use Akamai BMP at /solvers/akamai-bmp.
You send a `websiteURL` (a page on the target that loads bmak — usually the site root) and, optionally, the `endpoint` you captured plus your `userAgent`. We run bmak in the WRE sandbox with a captured real-Chrome profile (real canvas / WebGL / client-hints — no headless tells) and return the `sensorData` string, the current session's telemetry `endpoint`, the `userAgent` to replay with, and the `bmSz` seed the sensor is bound to. A warm session pool keeps bmak loaded, so each sensor is generated in ~30ms. No proxy is required — the sensor itself isn't IP-bound (only Akamai's `_abck` is), so you submit it from your own exit IP. Pass your own `userAgent` and we mint under it verbatim, as long as its Chrome major matches a captured profile (Chrome 150 or 151).
- Returns a valid bmak `sensor_data` string you submit yourself — you keep control of the session, cookies and IP
- ~30ms per sensor on a warm session (the site's bmak is kept loaded in a pooled real-Chrome sandbox)
- No proxy required — the sensor isn't IP-bound; submit it from your own exit
- Bring your own Chrome/150 or /151 User-Agent; we mint under it verbatim so UA and sensor stay coherent
- Real captured-Chrome fingerprint (canvas / WebGL / client-hints) — no headless or jsdom tells
Know what goes in.
Choose a field to see its purpose, where to get it, and its place in the request. Optional values omitted from the example can be added when your flow uses them.
The request below follows your selected task configuration.
Request authentication
Required task inputs
Optional context
websiteURL
stringRequiredA page on the target site that loads the bmak script — usually the site root, e.g. `https://www.example.com/`. bmak must run to produce a sensor; a bare API endpoint that returns no HTML won't work.
Copy the full page URL from the address bar or the document request in Network, including the path where this flow runs.
Open the input guidehttps://www.example.com/{
"clientKey": "capzy_YOUR_API_KEY",
"task": {
"type": "AkamaiSensorData",
"websiteURL": "https://www.example.com/"
}
}The selected field is highlighted when present. Preserve the declared value type and current challenge context.
Make your first request.
Create the task, keep its taskId, and poll until status is ready. Then read the selected variant's solution.
- Create the task
Send
clientKeyand the selectedtaskto/createTaskfrom your server. Keep the returnedtaskId. - Wait for the solution
Send that same key and ID to
/getTaskResult. While processing, wait two seconds before checking again. Stop on Ready or an error. - Apply the result
Send solution.sensorData to solution.endpoint in the original collector format, with the returned userAgent and bmSz context when supplied. Preserve response cookies before continuing the protected request.
import json, os, time
import requests
API = "https://api.capzy.ai"
KEY = os.environ["CAPZY_API_KEY"]
task = json.loads("{\"type\":\"AkamaiSensorData\",\"websiteURL\":\"https://www.example.com/\"}")
def call(path, payload):
response = requests.post(f"{API}/{path}", json={"clientKey": KEY, **payload}, timeout=30)
response.raise_for_status()
data = response.json()
if data.get("errorId", 0) or data.get("status") == "failed":
raise RuntimeError(data.get("errorDescription") or data.get("errorCode") or "Task failed")
return data
created = call("createTask", {"task": task})
for attempt in range(60):
result = call("getTaskResult", {"taskId": created["taskId"]})
if result.get("status") == "ready":
solution = result["solution"]
print(solution)
break
time.sleep(2)
else:
raise TimeoutError("Task is still processing; keep the taskId to check it later.")
Before runningReplace all illustrative inputs with your captured values. Set CAPZY_API_KEY in your environment. Install requests with pip install requests.
Polling and failuresThe example checks HTTP/API failures, uses 30-second request timeouts, and stops after 60 result checks. Retain taskId if your task is still processing.
Understand what comes back.
Follow this task from creation to completion. Response fields and usage follow your selected request variant.
sensorData + collector endpoint
Send solution.sensorData to solution.endpoint in the original collector format, with the returned userAgent and bmSz context when supplied. Preserve response cookies before continuing the protected request.
- string
- The Akamai `sensor_data` string. POST it as `{"sensor_data": "<this>"}` with `Content-Type: text/plain;charset=UTF-8` to the telemetry endpoint.
- string
- The current session's telemetry endpoint — POST the sensor here. Rotates per session, so use this one, not a stale captured URL.
- string
- The exact User-Agent the sensor was minted under. Pin it on your replay HTTP client — Akamai correlates the UA with the sensor.
- string
- The `bm_sz` session seed the sensor is bound to. Send this cookie alongside the sensor when you submit; without a matching bm_sz the sensor is rejected.
{
"errorId": 0,
"status": "ready",
"solution": {
"sensorData": "3;0;1;0;4342580;4/cPXoAcMzYVwpkvQ4lDmPF3GiHSlKVL2x3IdP1G0+o=;5,5,0,0,1,140;<encrypted telemetry>",
"endpoint": "https://www.example.com/AbCdEf12/gHiJkL/mNoPqR/8YJAkB",
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"bmSz": "80CCE11FCABD85049D5B685A24E843BF~YAAQ...~4342580~3748659"
}
}Illustrative values. Additional metadata may be returned; only Ready contains a completed solution.
Submit sensor_data and retain collector cookies
Install bmSz as bm_sz when present, submit sensorData under sensor_data to endpoint with the returned userAgent, and keep the collector's cookie updates. Continue in that same client and proxy; receiving a sensor alone is not proof that the protected action passed.
Execution context result is the parsed Ready response from the polling example. session, when referenced, is your existing requests.Session (or browser-compatible session) with the original cookie jar, headers, and solving proxy configured in session.proxies for both http and https. Keep this client for the complete flow. task is the task object you submitted. For Shape, action_body is the original protected request body as bytes or a string, with its original Content-Type in session.headers. Install curl_cffi when the fragment imports it; match the target's required browser/TLS identity.
sol = result["solution"]
from urllib.parse import urlsplit
if sol.get("bmSz"):
session.cookies.set("bm_sz", sol["bmSz"], domain=urlsplit(sol["endpoint"]).hostname, path="/")
session.headers["User-Agent"] = sol["userAgent"]
collector = session.post(sol["endpoint"], json={"sensor_data": sol["sensorData"]},
headers={"Content-Type": "application/json"}, timeout=30)
collector.raise_for_status()
# session keeps the collector's Set-Cookie updates, including _abck.
response = session.get(task["websiteURL"], timeout=30)
print(response.status_code)When something doesn't work.
Check your captured values, the selected variant, and the response before starting another task.
Do I need a proxy?
No. The `sensor_data` isn't bound to an IP — only Akamai's `_abck` cookie is, and you manage that on your own session. Generate the sensor here (proxyless), then POST it from your own exit IP. A proxy param is accepted for API symmetry but isn't required.
How do I submit the sensor?
POST `{"sensor_data": "<sensorData>"}` to the returned `endpoint` with `Content-Type: text/plain;charset=UTF-8` and the `userAgent` we returned, carrying the `bmSz` cookie (and your existing `_abck`). Akamai replies 201 and updates `_abck` / `bm_sz`.
Why do I get `_abck ~-1~` and not `~0~`?
`~-1~` (untrusted) is the normal state for an anonymous session and is sufficient for most Akamai-protected endpoints — they pass at `~-1~`. Akamai only grants a trusted `~0~` inside its own coherent session; a sensor you submit from your own client can't reach `~0~`. If you specifically need a `~0~` cookie, use the Akamai Web product, which mints and returns the full validated cookie family.
Which User-Agents are supported?
Chrome 150 and Chrome 151 on Windows x64 — we have captured device profiles for those. Pass your own UA (it's used verbatim) as long as its Chrome major matches, so the UA on your replay lines up with the sensor. Other browsers/versions aren't supported because the sensor fingerprint must match a real captured profile.
The endpoint I captured earlier stopped working — why?
Akamai rotates the telemetry endpoint per session (and per script deployment). A URL captured in an old session is stale. Just pass your `websiteURL`; we compute and return the correct endpoint for the current session in the `endpoint` field — always POST to that one.
Sensor Data vs Akamai Web — which do I need?
Sensor Data (this product) returns the raw `sensor_data` and lets YOU submit it and manage the session — fastest, cheapest, and enough for endpoints that pass at `~-1~`. Akamai Web mints the full validated `_abck` (`~0~`) cookie family server-side and returns cookies to replay. Use Web when you need the trusted cookie handed to you; use Sensor Data when you run your own session and just need the payload.
Integration checks for Akamai Sensor Data
- POST the sensor with the `bmSz` we return. The sensor is bound to that session seed — submit them together at the telemetry endpoint, or Akamai rejects it.
- Use the `userAgent` we return (or pass your own Chrome/150 or Chrome/151 UA and we mint under it verbatim). Akamai cross-checks the UA against the sensor signature; a mismatched major version is rejected.
- The telemetry endpoint ROTATES per session. Don't reuse a URL you captured earlier — pass your `websiteURL` and use the `endpoint` we return for the current session.
- This returns a `~-1~`-class sensor for you to submit yourself. Akamai only issues a trusted `~0~` `_abck` inside its own coherent session — if you need a validated `~0~` cookie, use Akamai Web at /solvers/akamai-web (we mint and return the cookie family).
Connect Akamai Sensor Data to your workflow.
Get your Capzy API key and use this guide's integration.
AkamaiSensorData · Live configuration