Imperva Incapsula
Choose the cookie flow that your page uses. Identify reese84 or utmvc before preparing the task. The script inputs and the way you apply the result differ between those families.
{
"clientKey": "capzy_YOUR_API_KEY",
"task": {
"type": "AntiImpervaTask",
"websiteURL": "https://www.example.com/",
"version": "reese84",
"scriptUrl": "https://www.example.com/s-weakes-Sir-Day-could-to-thy/1860025529848880788?s=xlD1csYd",
"proxyType": "http",
"proxyAddress": "123.45.67.89",
"proxyPort": "8080",
"proxyLogin": "user",
"proxyPassword": "pass"
}
}Illustrative values. Replace the inputs with values from your current integration.
Identify reese84 or utmvc.
Identify reese84 or utmvc before preparing the task. The script inputs and the way you apply the result differ between those families.
Your API key authenticates Capzy.
Provider keys, challenge IDs, images, and session values belong inside task.
Read the challenge script URL in Network.
- Inspect scripts loaded by the blocked page. A reese84 resource commonly uses a long dashed path; _Incapsula_Resource identifies the utmvc path.
- Copy the complete Request URL into scriptUrl and the parent page into websiteURL.
- Choose the matching reese84 or utmvc request variant. Preserve its version setting; the examples and response fields update together.
{
"websiteURL": "https://example.com/account",
"version": "utmvc",
"scriptUrl": "https://example.com/_Incapsula_Resource?YOUR_COMPLETE_QUERY"
}Use the actual captured script URL, including query parameters. The illustrated path is not a reusable challenge.
How Imperva Incapsula works
Imperva Incapsula is a CDN/WAF that protects ~27,000 sites including banks, insurance companies, and enterprise portals. It uses two JavaScript challenges: reese84 (a fingerprint 'interrogation' the browser POSTs back to a long dashed script URL to receive a reese84 cookie) and the older utmvc challenge (an _Incapsula_Resource script that computes a ___utmvc cookie from the incap_ses_* session cookies).
Tell us the challenge with version ("reese84" or "utmvc") and give us the scriptUrl. We run that script from a minimal host page under your target origin, so a half-loaded, region-redirected, or login-gated page no longer breaks detection. For reese84 we return the interrogation payload you POST back to that scriptUrl (the token comes in the response body, so you set reese84=<token> yourself). For utmvc we return the computed ___utmvc value. Send your proxy as the egress; the payload/value itself isn't bound to it, so keep the proxy sticky and reuse the returned userAgent.
- One scriptUrl for both challenges — pick reese84 or utmvc with version
- Solves from the challenge script alone — no full-site load required
- reese84 → the interrogation payload you POST back to your scriptUrl
- utmvc → the computed ___utmvc value from your incap_ses_* cookies
- Auto-detects the script URL when you send only websiteURL
Know what goes in.
Choose a field to see its purpose, where to get it, and its place in the request. Optional values omitted from the example can be added when your flow uses them.
Modern challenge — send version="reese84" and the reese84 script URL (a long dashed path; capture a FRESH one right before the task, they rotate). We return the interrogation payload you POST back to that URL to receive your reese84 cookie.
Request authentication
Required task inputs
Optional context
Proxy connection
websiteURL
stringRequiredThe Imperva-protected page URL
Copy the full page URL from the address bar or the document request in Network, including the path where this flow runs.
Open the input guidehttps://www.example.com/{
"clientKey": "capzy_YOUR_API_KEY",
"task": {
"type": "AntiImpervaTask",
"websiteURL": "https://www.example.com/",
"version": "reese84",
"scriptUrl": "https://www.example.com/s-weakes-Sir-Day-could-to-thy/1860025529848880788?s=xlD1csYd",
"proxyType": "http",
"proxyAddress": "123.45.67.89",
"proxyPort": "8080",
"proxyLogin": "user",
"proxyPassword": "pass"
}
}The selected field is highlighted when present. Preserve the declared value type and current challenge context.
Make your first request.
Create the task, keep its taskId, and poll until status is ready. Then read the selected variant's solution.
- Create the task
Send
clientKeyand the selectedtaskto/createTaskfrom your server. Keep the returnedtaskId. - Wait for the solution
Send that same key and ID to
/getTaskResult. While processing, wait two seconds before checking again. Stop on Ready or an error. - Apply the result
For reese84, submit the returned raw payload to your captured scriptUrl and install the response's cookie token. For utmvc, install ___utmvc alongside original Incapsula cookies. Then retry in the same identity/proxy session.
import json, os, time
import requests
API = "https://api.capzy.ai"
KEY = os.environ["CAPZY_API_KEY"]
task = json.loads("{\"type\":\"AntiImpervaTask\",\"websiteURL\":\"https://www.example.com/\",\"version\":\"reese84\",\"scriptUrl\":\"https://www.example.com/s-weakes-Sir-Day-could-to-thy/1860025529848880788?s=xlD1csYd\",\"proxyType\":\"http\",\"proxyAddress\":\"123.45.67.89\",\"proxyPort\":\"8080\",\"proxyLogin\":\"user\",\"proxyPassword\":\"pass\"}")
def call(path, payload):
response = requests.post(f"{API}/{path}", json={"clientKey": KEY, **payload}, timeout=30)
response.raise_for_status()
data = response.json()
if data.get("errorId", 0) or data.get("status") == "failed":
raise RuntimeError(data.get("errorDescription") or data.get("errorCode") or "Task failed")
return data
created = call("createTask", {"task": task})
for attempt in range(60):
result = call("getTaskResult", {"taskId": created["taskId"]})
if result.get("status") == "ready":
solution = result["solution"]
print(solution)
break
time.sleep(2)
else:
raise TimeoutError("Task is still processing; keep the taskId to check it later.")
Before runningReplace all illustrative inputs with your captured values. Set CAPZY_API_KEY in your environment. Install requests with pip install requests.
Polling and failuresThe example checks HTTP/API failures, uses 30-second request timeouts, and stops after 60 result checks. Retain taskId if your task is still processing.
Understand what comes back.
Follow this task from creation to completion. Response fields and usage follow your selected request variant.
Imperva cookies + browser identity
For reese84, submit the returned raw payload to your captured scriptUrl and install the response's cookie token. For utmvc, install ___utmvc alongside original Incapsula cookies. Then retry in the same identity/proxy session.
- string
- reese84 mode: the interrogation payload — POST it (raw body) to your scriptUrl to receive the reese84 token in the response body, then set reese84=<token>. (Cookie path: the reese84 cookie value.)
- string
- User-Agent the solve ran under — send this exact string on every request that uses the result
{
"errorId": 0,
"status": "ready",
"solution": {
"reese84": "{\"solution\":{\"interrogation\":{\"p\":\"9pp4bv7Sp0073gA1xoN9Aoo...E\",\"st\":1744612535,\"sr\":3851658681,\"cr\":937075512,\"og\":2},\"version\":\"beta\"},\"old_token\":null,\"error\":null,\"performance\":{\"interrogation\":488}}",
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
}
}Illustrative values. Additional metadata may be returned; only Ready contains a completed solution.
reese84
POST the raw reese84 payload to your original scriptUrl, read token from the body, and install it as the reese84 cookie. Keep the same proxy, cookie jar, and returned UA for both requests.
Execution context result is the parsed Ready response from the polling example. session, when referenced, is your existing requests.Session (or browser-compatible session) with the original cookie jar, headers, and solving proxy configured in session.proxies for both http and https. Keep this client for the complete flow. task is the task object you submitted. For Shape, action_body is the original protected request body as bytes or a string, with its original Content-Type in session.headers. Install curl_cffi when the fragment imports it; match the target's required browser/TLS identity.
sol = result["solution"]
session.headers["User-Agent"] = sol["userAgent"]
script_url = task["scriptUrl"]
verification = session.post(script_url, data=sol["reese84"],
headers={"Content-Type": "text/plain; charset=utf-8"}, timeout=30)
verification.raise_for_status()
token = verification.json()["token"]
session.cookies.set("reese84", token, domain="target.example.com", path="/")
response = session.get("https://target.example.com/", timeout=30)
print(response.status_code)When something doesn't work.
Check your captured values, the selected variant, and the response before starting another task.
reese84 or utmvc — which do I use?
Set version explicitly. reese84 is the modern challenge (a long dashed script URL): send version="reese84" + the scriptUrl; we return a payload you POST back to that same URL, and Imperva replies with the token in the response body (not Set-Cookie), so you set reese84=<token> yourself. utmvc is the older challenge (an _Incapsula_Resource script URL): send version="utmvc" + the scriptUrl + your incap_ses_* cookies, and we return the ___utmvc value to set as a cookie.
What if the page doesn't fully load?
That's exactly what this path fixes. We run the challenge script from a minimal host shell under your origin, so a half-rendered, region-redirected, or login-gated page no longer prevents the solve. Pass a fresh scriptUrl (they rotate per page load) so we can run the current script.
Do I need a proxy?
Send your proxy as the egress the script runs through. The reese84 payload / ___utmvc value we return isn't bound to that IP — you perform the final POST / cookie-set from your own session — so keep your proxy sticky and reuse the returned userAgent.
Connect Imperva Incapsula to your workflow.
Get your Capzy API key and use this guide's integration.
AntiImpervaTask · Live configuration