Is this available now?

It's a limited-availability beta. Shape's telemetry is single-use per request and per-deployment, so it isn't a simple reusable-token product — the task type may return ERROR_TASK_TYPE_DISABLED. Contact us before building against it for production volume.

Why can't you just return a token I reuse?

Shape signs each request with fresh, single-use telemetry rather than issuing a long-lived cookie/token. So each solve covers one request: attach the returned headers to the very next call through the same proxy, then re-solve. There's no token to cache.

Is this the same as F5 BIG-IP?

No. F5 BIG-IP Advanced WAF (/solvers/f5-bigip) is a different product that sets replayable TS / TSPD / f5avr cookies. F5 Distributed Cloud Bot Defense (this page, ex-Shape Security) uses VM-bytecode telemetry with no reusable token.

Before you submit — these must be correct

If any of these are wrong, your token may be accepted by our solver but rejected or scored poorly by the target site.

Beta / limited availability. Shape's telemetry is single-use per request and per-deployment — it is not a reusable token. This task type may return ERROR_TASK_TYPE_DISABLED; contact us before integrating for production volume.
The header set + cookies are single-use and IP-bound. Attach them to the very next request through the SAME proxy, then re-solve. They do not replay at volume.
This is NOT F5 BIG-IP AWAF. If your target sets TS / TSPD / f5avr cookies, use /solvers/f5-bigip instead — that's a different F5 product with a replayable cookie.
Use the userAgent we return. The telemetry signature is bound to the browser identity that produced it.

F5 Distributed Cloud Bot Defense (Shape)

AntiF5ShapeTask

proxy required

F5 Distributed Cloud Bot Defense (Shape) Solver, solved in 5.0s.

Beta — solve F5 Distributed Cloud Bot Defense (ex-Shape) by capturing its live per-request telemetry headers. Limited availability: the header set is single-use per request.

Get API Key Try Demo Examples

Avg Speed~5.0s

Success99%+

Cost / 1k$2.00

Throughput12/m

F5 Distributed Cloud Bot Defense (formerly Shape Security) is a high-end anti-bot layer distinct from F5 BIG-IP AWAF. It collects behavioral telemetry through a VM-bytecode script and signs each protected request with a dynamic, per-deployment header set (encrypted, rotating). It's used by banks, airlines, and large retailers. Unlike a cookie-based WAF, Shape's telemetry is single-use per request — there's no long-lived token to hand back — which is why this is a limited-availability product rather than a simple token API.

Quick Integration

solve.py

import requests, time

API = "https://api.capzy.ai"
KEY = "capzy_your_key_here"

# Step 1: Create task
task = requests.post(f"{API}/createTask", json={
    "clientKey": KEY,
    "task": {
        "type": "AntiF5ShapeTask",
        "websiteURL": "https://example.com/login",
        "proxyType": "http",
        "proxyAddress": "123.45.67.89",
        "proxyPort": "8080",
        "proxyLogin": "user",
        "proxyPassword": "pass"
    }
}).json()

task_id = task["taskId"]
print(f"Task created: {task_id}")

# Step 2: Poll for result
while True:
    result = requests.post(f"{API}/getTaskResult", json={
        "clientKey": KEY,
        "taskId": task_id
    }).json()

    if result["status"] == "ready":
        print("Solved!", result["solution"])
        break
    elif result["status"] == "failed":
        print("Failed:", result.get("errorDescription"))
        break

    time.sleep(1)

Using the result

use_result.py

# Step 3: Use the result — set every cookie on a session jar
sol = result["solution"]
session = requests.Session()
for c in sol["cookies"]:
    session.cookies.set(c["name"], c["value"], domain=c.get("domain"), path=c.get("path", "/"))
session.headers["User-Agent"] = sol.get("userAgent", "")
# IMPORTANT: route through the SAME proxy you supplied at solve time
resp = session.get("https://target.example.com/", proxies={
    "http":  "http://USER:PASS@PROXY_HOST:PORT",
    "https": "http://USER:PASS@PROXY_HOST:PORT",
})
print(resp.status_code, len(resp.text), "bytes")

1. Send Payload

Dispatch your AntiF5ShapeTask to our processing cluster via the secure API endpoint.

2. Solving Engine

We launch a real browser through your proxy, let Shape's script bootstrap and collect telemetry with simulated interaction, then capture the dynamic header set + trust cookies minted during that session. You get the headers to attach to the immediately-following request. Because the header set is single-use and tied to the solving IP, a sticky proxy you control is required, and each solve covers one request.

3. Get Result

Poll getTaskResult for the validated token, then finalize your automated request.

Task Parameters

API Spec

Proxy fields below are required for this captcha — userAgent must match the one you’ll use when submitting the resulting token.

fieldtyperequireddescription

typetypestringreqyesAntiF5ShapeTask (bring your own proxy) or AntiF5ShapeTaskProxyLess (routed for you)

websiteURLtypestringreqyesThe F5 Distributed Cloud Bot Defense-protected page URL

userAgenttypestringreqnoAdvisory — we solve with a coherent real browser and RETURN the User-Agent the telemetry is bound to. Pin that value on the replay request.

proxyTypetypestringreqyesProxy protocol: http, https, socks4, or socks5

proxyAddresstypestringreqyesProxy IP address or hostname

proxyPorttypenumberreqyesProxy port number

proxyLogintypestringreqnoProxy username (if auth required)

proxyPasswordtypestringreqnoProxy password (if auth required)

userAgenttypestringreqnoUser-Agent string to use. Must match the UA you use when submitting the token

Response Shape

fieldtypedescription

headerstypeobjectThe dynamic telemetry headers as {name: value} — attach these to your immediately-following request. Header names are per-deployment (e.g. x-<id>-a / x-<id>-c).

cookiestypearrayThe Shape trust cookies (_shapesec_*) minted during the solve, as {name, value, domain, path}

userAgenttypestringThe User-Agent the telemetry is bound to — reuse it on the replay request

singleUsetypebooleanAlways true — the header set is valid for ONE request. Re-solve for the next.

ipBoundtypebooleanAlways true — telemetry is tied to the solving IP; replay through the same proxy

telemetrySignaturetypestringThe detected per-deployment signature id (diagnostic)

Example response

{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "headers": {
      "x-ee30zvqlwf-a": "<encrypted telemetry>",
      "x-ee30zvqlwf-c": "<second header>"
    },
    "cookies": [
      {
        "name": "_shapesec_ts",
        "value": "<value>",
        "domain": ".example.com",
        "path": "/"
      },
      {
        "name": "_shapesec_rs",
        "value": "<value>",
        "domain": ".example.com",
        "path": "/"
      }
    ],
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
    "singleUse": true,
    "ipBound": true,
    "telemetrySignature": "ee30zvqlwf"
  }
}

Error response

{
  "errorId": 1,
  "errorCode": "ERROR_CAPTCHA_UNSOLVABLE",
  "errorDescription": "Solver gave up."
}

Features

Captures the live per-request telemetry header set + trust cookies

Handles the rotating, per-deployment Shape signature

Returns the exact User-Agent the telemetry is bound to

Distinct from F5 BIG-IP AWAF (that's a separate, cookie-based product)

Pricing & Stats

Per 1,000 solves$2.00

Avg solve time~5.0s

Success rate99%+