> For the complete documentation index, see [llms.txt](https://docs.takionapi.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.takionapi.tech/incapsula/___utmvc.md).

# \_\_\_utmvc Bypass Solution

### How the solution works <a href="#how-the-solution-works" id="how-the-solution-works"></a>

To bypass Incapsula's (Imperva's) protection, follow these steps:

1. **Find the \_\_\_utmvc script URL.**
2. **Load the script content.**
3. **Generate the cookie based on it** (using our API).

### How to identify the script URL <a href="#how-to-identify-the-script-url" id="how-to-identify-the-script-url"></a>

After visiting the target website, you can easily search for the following regex inside the HTML content. It will find and extract the needed URL.

`src="(/_Incapsula_Resource?[^"]+)"`

### Endpoint <a href="#endpoint" id="endpoint"></a>

The endpoint lives on the Castle subdomain:

```
https://incapsula.takionapi.tech/utmvc
```

## Generate the \_\_\_utmvc cookie

> Send the \`\_Incapsula\_Resource\` script content plus your current session cookies and get back the \`\_\_\_utmvc\` cookie to set before retrying the original request.<br>

```json
{"openapi":"3.0.3","info":{"title":"Takion API — Incapsula / Imperva","version":"1.0.0"},"servers":[{"url":"https://incapsula.takionapi.tech"}],"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"components":{"securitySchemes":{"ApiKeyHeader":{"type":"apiKey","in":"header","name":"x-api-key"},"ApiKeyQuery":{"type":"apiKey","in":"query","name":"api_key"}},"schemas":{"UtmvcRequest":{"type":"object","required":["content","cookies"],"properties":{"content":{"type":"string","description":"The response text of the `_Incapsula_Resource` challenge script fetched from the target site.\n"},"cookies":{"type":"array","description":"The current session cookies as `[name, value]` pairs.","items":{"type":"array","items":{"type":"string"},"minItems":2,"maxItems":2}}},"additionalProperties":true},"UtmvcResponse":{"type":"object","properties":{"___utmvc":{"type":"string","description":"The `___utmvc` cookie value to set on your session."}},"additionalProperties":true},"Error":{"type":"object","required":["error"],"description":"Every error is a JSON object with a single `error` string. Auth/quota problems return HTTP 401 and unexpected failures 500; input-validation errors are returned with this same shape — always check for `error`.\n","properties":{"error":{"type":"string"}}}},"responses":{"Unauthorized":{"description":"Authentication or quota failure — HTTP 401 with an `error` message.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"ServerError":{"description":"Unexpected server error (HTTP 500).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/utmvc":{"post":{"operationId":"generateUtmvc","summary":"Generate the ___utmvc cookie","description":"Send the `_Incapsula_Resource` script content plus your current session cookies and get back the `___utmvc` cookie to set before retrying the original request.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UtmvcRequest"}}}},"responses":{"200":{"description":"The `___utmvc` cookie. On a bad request an `error` field is returned instead — check for `error` first.\n","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/UtmvcResponse"},{"$ref":"#/components/schemas/Error"}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/ServerError"}}}}}}
```