> For the complete documentation index, see [llms.txt](https://docs.takionapi.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.takionapi.tech/incapsula/reese84.md).

# reese84 Bypass Solution

## How the solution works <a href="#how-the-solution-works" id="how-the-solution-works"></a>

To bypass Incapsula's (Imperva's) protection, follow these steps:

1. **Load the script content.**
2. **Generate the challenge payload** (using our API).
3. **Post the payload** to retrieve the Incapsula cookie.

#### How to identify the script URL <a href="#how-to-identify-the-script-url" id="how-to-identify-the-script-url"></a>

After visiting the target website, open your browser inspector tools and click on the network tab. The browser should have sent a request to a URL like `https://whatever.com/anoy-route?d=www.yourtargetwebsite.com`.

This is the script tag. All the responses should have returned a JSON body with `token` as one of the keys.

### Endpoint <a href="#endpoint" id="endpoint"></a>

The endpoint lives on the Castle subdomain:

```
https://incapsula.takionapi.tech/reese84
```

## Generate the reese84 payload

> Send the reese84 challenge script (fetched from the target's \`?d=\<domain>\` route) and get back the challenge payload. Post that payload to the site's reese84 endpoint; the response carries the \`token\` to set as the \`reese84\` cookie.<br>

```json
{"openapi":"3.0.3","info":{"title":"Takion API — Incapsula / Imperva","version":"1.0.0"},"servers":[{"url":"https://incapsula.takionapi.tech"}],"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"components":{"securitySchemes":{"ApiKeyHeader":{"type":"apiKey","in":"header","name":"x-api-key"},"ApiKeyQuery":{"type":"apiKey","in":"query","name":"api_key"}},"schemas":{"Reese84Request":{"type":"object","required":["script"],"properties":{"script":{"type":"string","description":"The response text of the reese84 challenge script fetched from the target site (the `?d=<domain>` route whose JSON body contains `token`).\n"}},"additionalProperties":true},"Reese84Response":{"type":"object","properties":{"payload":{"type":"string","description":"The challenge payload. Post it to the site's reese84 endpoint; the response contains the `token` to set as the `reese84` cookie.\n"}},"additionalProperties":true},"Error":{"type":"object","required":["error"],"description":"Every error is a JSON object with a single `error` string. Auth/quota problems return HTTP 401 and unexpected failures 500; input-validation errors are returned with this same shape — always check for `error`.\n","properties":{"error":{"type":"string"}}}},"responses":{"Unauthorized":{"description":"Authentication or quota failure — HTTP 401 with an `error` message.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"ServerError":{"description":"Unexpected server error (HTTP 500).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/reese84":{"post":{"operationId":"generateReese84","summary":"Generate the reese84 payload","description":"Send the reese84 challenge script (fetched from the target's `?d=<domain>` route) and get back the challenge payload. Post that payload to the site's reese84 endpoint; the response carries the `token` to set as the `reese84` cookie.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Reese84Request"}}}},"responses":{"200":{"description":"The challenge payload. On a bad request an `error` field is returned instead — check for `error` before reading `payload`.\n","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/Reese84Response"},{"$ref":"#/components/schemas/Error"}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/ServerError"}}}}}}
```