Incapsula reese84 solver API

Send Imperva's reese84 script, get back the sensor your client posts to receive the reese84 token. No browser, no headless farm, and nothing to pay when a solve fails.

Get your API key See the request

How Imperva issues reese84, and where Parsa fits

Challenge: reese84
Answer time: ~0.5 ms; ~70 ms for a new script
Browsers: Chrome on Windows or macOS
Price: €1.50 / 1,000
Billed: Only answers that come back 200

Measured in November 2026 on our own solvers; how, under benchmarks.

What is Incapsula reese84?

Incapsula is the web application firewall and bot protection that Imperva, now part of Thales, sells under the name Advanced Bot Protection. Its browser check is called reese84 after the cookie it sets. A protected page loads a script from its own domain at a path made of random words; the script measures the browser, posts what it found to that same path and receives a token, which becomes the reese84 cookie. Some sites send it as an x-d-token header instead.

The script is not ordinary JavaScript. It is a bytecode virtual machine with its program embedded in the file, and each field it reports passes through its own chain of reversible transformations, keyed from a number chosen for that request. The record it posts describes the device in detail: the user agent and platform, languages, screen, the graphics card's vendor and renderer, canvas results and timings. The server can check all of it and signs the token it returns.

A plain HTTP client doesn't run the script, so it never holds a token and the protected requests fail. Parsa lifts the script's program statically, without a browser, and writes the record for a real device consistent with your user agent and the page you are on. You post it, and the token comes from Imperva itself: we never forge one.

How Incapsula reese84 works, in depth →

The Incapsula challenge

reese84

POST /incapsula/reese84 · €1.50 / 1,000

You have reese84 when a site sets a cookie of that name, sends an x-d-token header, or loads a script from a path of random words on its own domain, sometimes with ?s= after it. Fetch that script with your browser-like client and send it to us with the page's URL and your user agent.

We answer with the sensor as a JSON string. Post it unchanged to the script's URL with ?d= and the site's host added, as text/plain, over HTTP/2. Imperva replies with the token, the number of seconds until you should renew it and the cookie's domain. Set reese84 to the token and the site lets you through.

The token expires within minutes; the renewInSec values we've seen were around ten to fifteen. Renewing doesn't need a new solve: post the current token back to the same URL and Imperva issues a fresh one. Only a new session, or a token that was refused, needs another call to Parsa.

Some Imperva sites serve a different, dynamic variant behind a "Pardon Our Interruption" page with a proof of work. That variant isn't supported yet; the pow field is accepted and ignored.

You send

userAgent: Chrome on Windows or macOS
pageUrl: The protected page
script: The body of your GET to the script
scriptUrl: Where the script came from
ip: Your proxy's exit IP
acceptLanguage: The Accept-Language you send

You get back

payload: The sensor, a JSON string, to post as is to scriptUrl?d=<host>

The request

Your client fetches the reese84 script from its random-word path, sends it with the page URL to POST /incapsula/reese84, and posts the payload unchanged to scriptUrl?d=<host> as text/plain over HTTP/2. It stores the token as the reese84 cookie and renews it before renewInSec by posting the old token back.

Keep these the same for the whole session

One exit IP, sticky, and the same one you send us as ip
A Chrome TLS and HTTP/2 fingerprint and Chrome's header order
The user agent and Accept-Language the payload describes
One cookie jar, from the first page load to the protected request

curlPythonNode

POST /incapsula/reese84

curl https://api.parsalabs.io/incapsula/reese84 \
  -H "Authorization: Bearer parsa_…" \
  -H "Content-Type: application/json" \
  -d '{
    "userAgent":      "Mozilla/5.0 (Windows NT 10.0; …)",
    "pageUrl":        "https://shop.example.com/",
    "scriptUrl":      "https://shop.example.com/vice-come-x",
    "script":         "<the script>",
    "ip":             "203.0.113.7",
    "acceptLanguage": "en-US,en;q=0.9"
  }'

# 200 OK · charged €0.0015
{
  "payload": "{…}"
}

import requests
from curl_cffi import requests as browser

s = browser.Session(impersonate="chrome", proxy=PROXY)
script = s.get(script_url).text

ans = requests.post(
    "https://api.parsalabs.io/incapsula/reese84",
    headers={"Authorization": "Bearer parsa_…"},
    json={"userAgent": UA, "pageUrl": page_url,
          "script": script, "scriptUrl": script_url,
          "ip": exit_ip, "acceptLanguage": "en-US,en;q=0.9"},
).json()

r = s.post(f"{script_url}?d={host}", data=ans["payload"],
           headers={"Content-Type": "text/plain; charset=utf-8"})
s.cookies.set("reese84", r.json()["token"], domain=host)

const res = await fetch("https://api.parsalabs.io/incapsula/reese84", {
  method: "POST",
  headers: {
    "Authorization": "Bearer parsa_…",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    userAgent, pageUrl, script, scriptUrl,
    ip: exitIp,
    acceptLanguage: "en-US,en;q=0.9",
  }),
});
const { payload } = await res.json();
// POST payload to `${scriptUrl}?d=${host}` as text/plain
// from your Chrome-fingerprinted client; the reply's
// token is the reese84 cookie.

Benchmarks

Measured on our solver with a real reese84 script of 800 KB. The time is what we spend writing the sensor, which your client waits for on top of the round trip to api.parsalabs.io. A browser has to download and run the same virtual machine in the page.

Measure	Parsa	Headless Chromium
Sensor for a known script	About 0.5 ms	The script's VM runs in the page
First sensor for a new script	About 70 ms, the script's lift included	The page and script load each session
Renewing the token	No solve needed: post the old token	The script renews it in the page
Memory per session	None on your side: a JSON request	277 MB for the first, about 102 MB for each one after
Ten sessions at once	Ten HTTPS requests	1,198 MB of Chromium
Start-up, before any network	None	About 100 ms to launch and load an empty page

Parsa figures: one solver on an Apple M5 Pro, the first solve of the script and then the mean of 50 more, in process. All 74 parts of the record's template come out identical after a decode and re-encode.
We haven't published a live success rate for reese84 yet. Your dashboard shows your own rate, live, and only the 200s are billed.
Browser figures: Playwright's Chromium headless shell on an Apple M5 Pro, loading a local page with 1 MB of script and no network, median of five runs. They are a floor: a real protected page adds its own network round trips and the challenge's run time on top.

Incapsula pricing

€1.50per 1,000 solves

Prepaid from €5, no plan and no monthly fee. Only an answer that comes back 200 is billed: an error, a timeout or a build we can't read costs nothing.

reese84: €1.50 / 1,000

Get your API key All prices

Incapsula questions

Is Incapsula the same as Imperva?

Yes. Incapsula was the company and product Imperva bought in 2014; its bot protection is sold today as Imperva Advanced Bot Protection, and the script and cookie still call it reese84.

How do I find the reese84 script URL?

It is on the site's own domain, at a path of a few random words, sometimes followed by ?s=. The page loads it with a script tag, and it is the URL the token request goes to.

How long does a reese84 token last?

A few minutes. Imperva tells you in renewInSec; the values we've seen were around ten to fifteen minutes. Renew by posting the current token to the same URL before that time runs out.

What about incap_ses, visid_incap and ___utmvc?

Those are Incapsula's older cookies and its classic utmvc challenge. This API solves reese84. Keep the other cookies in your jar as the site sets them.

Which user agents can I send?

Chrome on Windows or macOS. We describe a real machine from a set of 53, so the platform, graphics card and fonts in the sensor agree with the user agent.

Am I charged for a solve that fails?

No. A reese84 sensor costs €0.0015, and only when the API answers 200. An invalid script, a user agent we don't support or any other error is free.

GuideHow Incapsula reese84 worksRead the guide →