Skip to content
capzy
Login

F5 Distributed Cloud · Shape

Prepare the protected API request and its telemetry. Capture the exact API action that needs Shape telemetry. The parent page arms the SDK; targetApi tells the solver which request to generate headers for.

Get the integration code
POST /createTask · example
{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "AntiF5ShapeTask",
    "websiteURL": "https://example.com/account",
    "targetApi": "https://example.com/api/order",
    "targetApiMethod": "POST",
    "referer": "https://example.com/account",
    "cookies": {
      "SESSION": "<your live session cookie>",
      "auth_token": "<your auth cookie>"
    },
    "proxyType": "http",
    "proxyAddress": "123.45.67.89",
    "proxyPort": "8080",
    "proxyLogin": "user",
    "proxyPassword": "pass"
  }
}

Illustrative values. Replace the inputs with values from your current integration.

Page URL + target API + proxyYour session proxy requiredRequest headers + cookies + identity

Capture the protected API context.

Capture the exact API action that needs Shape telemetry. The parent page arms the SDK; targetApi tells the solver which request to generate headers for.

Your API key authenticates Capzy.
Provider keys, challenge IDs, images, and session values belong inside task.

Match the method and referring page.

  1. Use the login/cart/checkout page that loads Shape as websiteURL. In Network, select the protected API action.
  2. Copy its complete Request URL into targetApi and Request Method into targetApiMethod.
  3. Copy the original Referer header into referer. Keep its body and application headers in your client for the eventual replay.
Input collection example - replace illustrative values
{
  "websiteURL": "https://example.com/account",
  "targetApi": "https://example.com/api/order",
  "targetApiMethod": "POST",
  "referer": "https://example.com/account"
}

targetApi is strongly recommended. Without it, the page must naturally issue a protected request for telemetry to be captured.

How F5 Distributed Cloud · Shape works

F5 Distributed Cloud Bot Defense (formerly Shape Security) is a high-end anti-bot layer distinct from F5 BIG-IP AWAF. It collects behavioral telemetry through a VM-bytecode script and signs each protected request with a dynamic, per-deployment header set (encrypted, rotating). It's used by banks, airlines, and large retailers. Unlike a cookie-based WAF, Shape's telemetry is single-use per request — there's no long-lived token to hand back — which is why this is a limited-availability product rather than a simple token API.

We launch a real browser through your proxy, let Shape's script bootstrap and collect telemetry with simulated interaction, then capture the dynamic header set + trust cookies minted during that session. Pass targetApi (the protected endpoint you'll replay) and we fire that exact request from the page during the solve, so the telemetry set is minted for precisely that call — this is the reliable path. You get the headers to attach to the immediately-following request. Because the header set is single-use and tied to the solving IP, a sticky proxy you control is required, and each solve covers one request.

  • Captures the live per-request telemetry header set + trust cookies
  • Handles the rotating, per-deployment Shape signature
  • Returns the exact User-Agent the telemetry is bound to
  • Distinct from F5 BIG-IP AWAF (that's a separate, cookie-based product)

Know what goes in.

Choose a field to see its purpose, where to get it, and its place in the request. Optional values omitted from the example can be added when your flow uses them.

Keep your proxy exit and session identity consistent when using this result.

Request authentication

Required task inputs

Optional context

Proxy connection

websiteURL

stringRequired

The F5 Distributed Cloud Bot Defense-protected page URL — use a page that actually loads the Shape script (e.g. the login/cart/checkout page of the flow you're automating)

Where it comes from

Copy the full page URL from the address bar or the document request in Network, including the path where this flow runs.

Open the input guide
Example valuehttps://example.com/account
POST /createTask · selected configuration
{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "AntiF5ShapeTask",
    "websiteURL": "https://example.com/account",
    "targetApi": "https://example.com/api/order",
    "targetApiMethod": "POST",
    "referer": "https://example.com/account",
    "cookies": {
      "SESSION": "<your live session cookie>",
      "auth_token": "<your auth cookie>"
    },
    "proxyType": "http",
    "proxyAddress": "123.45.67.89",
    "proxyPort": "8080",
    "proxyLogin": "user",
    "proxyPassword": "pass"
  }
}

The selected field is highlighted when present. Preserve the declared value type and current challenge context.

Make your first request.

Create the task, keep its taskId, and poll until status is ready. Then read the selected variant's solution.

More examples
  1. Create the task

    Send clientKey and the selected task to /createTask from your server. Keep the returned taskId.

  2. Wait for the solution

    Send that same key and ID to /getTaskResult. While processing, wait two seconds before checking again. Stop on Ready or an error.

  3. Apply the result

    Apply every returned telemetry header and scoped cookie, preserve solution.userAgent, and replay the original API method/body through the same exit. Respect singleUse and ipBound metadata.

AntiF5ShapeTask · $2.00 / 1,000
solve_f5_shape.py
import json, os, time
import requests

API = "https://api.capzy.ai"
KEY = os.environ["CAPZY_API_KEY"]
task = json.loads("{\"type\":\"AntiF5ShapeTask\",\"websiteURL\":\"https://example.com/account\",\"targetApi\":\"https://example.com/api/order\",\"targetApiMethod\":\"POST\",\"referer\":\"https://example.com/account\",\"cookies\":{\"SESSION\":\"<your live session cookie>\",\"auth_token\":\"<your auth cookie>\"},\"proxyType\":\"http\",\"proxyAddress\":\"123.45.67.89\",\"proxyPort\":\"8080\",\"proxyLogin\":\"user\",\"proxyPassword\":\"pass\"}")

def call(path, payload):
    response = requests.post(f"{API}/{path}", json={"clientKey": KEY, **payload}, timeout=30)
    response.raise_for_status()
    data = response.json()
    if data.get("errorId", 0) or data.get("status") == "failed":
        raise RuntimeError(data.get("errorDescription") or data.get("errorCode") or "Task failed")
    return data

created = call("createTask", {"task": task})
for attempt in range(60):
    result = call("getTaskResult", {"taskId": created["taskId"]})
    if result.get("status") == "ready":
        solution = result["solution"]
        print(solution)
        break
    time.sleep(2)
else:
    raise TimeoutError("Task is still processing; keep the taskId to check it later.")

Before runningReplace all illustrative inputs with your captured values. Set CAPZY_API_KEY in your environment. Install requests with pip install requests.

Polling and failuresThe example checks HTTP/API failures, uses 30-second request timeouts, and stops after 60 result checks. Retain taskId if your task is still processing.

Understand what comes back.

Follow this task from creation to completion. Response fields and usage follow your selected request variant.

Request headers + cookies + identity

Apply every returned telemetry header and scoped cookie, preserve solution.userAgent, and replay the original API method/body through the same exit. Respect singleUse and ipBound metadata.

object
The dynamic telemetry headers as {name: value} — attach ALL of them to your immediately-following request. The set includes short members (some values are just a few characters); protected writes are rejected unless the complete set is replayed. Header names are per-deployment (e.g. <id>-a / <id>-b / <id>-c / <id>-z).
array
The cleared-session cookie jar (including any _shapesec_* trust cookies) minted during the solve, as {name, value, domain, path}
string
The User-Agent the telemetry is bound to — reuse it on the replay request
boolean
Always true — the header set is valid for ONE request. Re-solve for the next.
boolean
Always true — telemetry is tied to the solving IP; replay through the same proxy
boolean
Whether the Shape telemetry signature and/or a _shapesec_ trust cookie was confirmed during the solve
array
The header names forming the Shape signature — the subset of headers that is the telemetry set (vs. incidental app headers)
POST /getTaskResult · example response
{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "headers": {
      "ee30zvqlwf-a": "<encrypted telemetry blob>",
      "ee30zvqlwf-b": "<short per-request value>",
      "ee30zvqlwf-c": "<encrypted telemetry>",
      "ee30zvqlwf-d": "<encrypted telemetry>",
      "ee30zvqlwf-f": "<encrypted telemetry>",
      "ee30zvqlwf-z": "q"
    },
    "cookies": [
      {
        "name": "_shapesec_ts",
        "value": "<value>",
        "domain": ".example.com",
        "path": "/"
      },
      {
        "name": "_shapesec_rs",
        "value": "<value>",
        "domain": ".example.com",
        "path": "/"
      }
    ],
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
    "singleUse": true,
    "ipBound": true,
    "shapeDetected": true,
    "telemetrySignature": [
      "ee30zvqlwf-a",
      "ee30zvqlwf-b",
      "ee30zvqlwf-c",
      "ee30zvqlwf-d",
      "ee30zvqlwf-f",
      "ee30zvqlwf-z"
    ]
  }
}

Illustrative values. Additional metadata may be returned; only Ready contains a completed solution.

Replay the complete Shape header set once

Use the complete solution.headers object, every returned cookie, and userAgent on the original targetApi action and method. Keep its body, application headers, and solving proxy. The telemetry set is valid for one request; re-solve for another action.

Execution context result is the parsed Ready response from the polling example. session, when referenced, is your existing requests.Session (or browser-compatible session) with the original cookie jar, headers, and solving proxy configured in session.proxies for both http and https. Keep this client for the complete flow. task is the task object you submitted. For Shape, action_body is the original protected request body as bytes or a string, with its original Content-Type in session.headers. Install curl_cffi when the fragment imports it; match the target's required browser/TLS identity.

Use the result · Python
sol = result["solution"]
for cookie in sol["cookies"]:
    session.cookies.set(cookie["name"], cookie["value"],
        domain=cookie["domain"], path=cookie.get("path", "/"))
headers = {**session.headers, **sol["headers"], "User-Agent": sol["userAgent"]}
method = task.get("targetApiMethod", "GET").upper()
response = session.request(method, task["targetApi"], headers=headers,
    data=None if method in ("GET", "HEAD") else action_body, timeout=30)
print(response.status_code)
# This header set is consumed. Generate a new set for the next request.

When something doesn't work.

Check your captured values, the selected variant, and the response before starting another task.

Is this available now?

It's a limited-availability beta. Shape's telemetry is single-use per request and per-deployment, so it isn't a simple reusable-token product — the task type may return ERROR_TASK_TYPE_DISABLED. Contact us before building against it for production volume.

Why can't you just return a token I reuse?

Shape signs each request with fresh, single-use telemetry rather than issuing a long-lived cookie/token. So each solve covers one request: attach the returned headers to the very next call through the same proxy, then re-solve. There's no token to cache.

Is this the same as F5 BIG-IP?

No. F5 BIG-IP Advanced WAF (/solvers/f5-bigip) is a different product that sets replayable TS / TSPD / f5avr cookies. F5 Distributed Cloud Bot Defense (this page, ex-Shape Security) uses VM-bytecode telemetry with no reusable token.

The solve succeeds but returns no headers — why?

On many deployments Shape loads its VM and wraps fetch/XHR but withholds the telemetry header set until it sees a valid session — typically a logged-in one. An anonymous cold solve gets the VM but no token. Pass your live session cookies via the `cookies` param (and point targetApi at the exact protected endpoint) so the VM arms inside your session and stamps the request. Reuse the same session + IP + userAgent on your replay.

Integration checks for F5 Distributed Cloud · Shape
  • Beta / limited availability. Shape's telemetry is single-use per request and per-deployment — it is not a reusable token. This task type may return ERROR_TASK_TYPE_DISABLED; contact us before integrating for production volume.
  • The header set + cookies are single-use and IP-bound. Attach them to the very next request through the SAME proxy, then re-solve. They do not replay at volume.
  • This is NOT F5 BIG-IP AWAF. If your target sets TS / TSPD / f5avr cookies, use /solvers/f5-bigip instead — that's a different F5 product with a replayable cookie.
  • Use the userAgent we return. The telemetry signature is bound to the browser identity that produced it.
  • If your protected request needs a logged-in session, pass your live session cookies via `cookies` — Shape often gives an anonymous browser the VM but withholds the header set until it sees an authenticated session. Without them the solve can run yet return no headers.

Connect F5 Distributed Cloud · Shape to your workflow.

Get your Capzy API key and use this guide's integration.

Get an API key Full API documentation
$2.00Per 1,000 solves
15.3sAverage solve time

AntiF5ShapeTask · Live configuration