> For the complete documentation index, see [llms.txt](https://docs.hypersolutions.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hypersolutions.co/incapsula/getting-started.md).

# Getting started

Incapsula, now **Imperva**, guards login, checkout, and API endpoints across enterprise sites. It fingerprints the runtime with **reese84**, gates access behind the **`___utmvc`** cookie, and can escalate to a captcha when trust drops. Our API reproduces the reese84 and `___utmvc` payloads from a single HTTP call, so you don't have to run the obfuscated challenge scripts in a browser.

### reese84 vs UTMVC

These are two separate layers. Some sites use one, some use both:

* **reese84** is the core sensor: a signed JavaScript fingerprint payload posted back before the site issues a valid `reese84` token. It comes in two forms:
  * **Static** (background sensor, no challenge page), see [Reese84](/incapsula/reese84.md).
  * **Dynamic** (a "Pardon Our Interruption" page, often with a Proof of Work step), see [Reese84 Dynamic](/incapsula/reese84-dynamic.md).
* **UTMVC** is a separate challenge layer: a rotating, obfuscated script that, when executed correctly, issues the `___utmvc` cookie that authorizes the session. See [UTMVC](/incapsula/utmvc.md).

If trust is low, Incapsula can fall back to an **hCaptcha or GeeTest** challenge inside an iframe. Hyper Solutions does not solve those, see [Incapsula Captcha Block](/incapsula/incapsula-captcha-block.md).

### Which protection does my site use?

**UTMVC**: the page loads a script that looks like this:

```
/_Incapsula_Resource?SWJIYLWA=...
```

**reese84**: the browser holds a cookie named `reese84`, or you see an `x-d-token` header on requests. If the site serves a **"Pardon Our Interruption"** page, it's the [dynamic](/incapsula/reese84-dynamic.md) variant.

### FAQ

**My requests still get blocked even though the payload looks valid.** The usual culprits are an **IP mismatch** (the `ip` you pass must match your egress IP, use a sticky proxy), a **rotated User-Agent**, or an **unhandled UTMVC or captcha layer**. See [Core Requirements](/start-here/core-requirements.md).

**Do I need to solve the captcha?** Only if the site escalates to one. Hyper Solutions handles reese84 and `___utmvc`; captcha blocks require a third-party solver, see [Incapsula Captcha Block](/incapsula/incapsula-captcha-block.md).

**How long is a token good for?** The reese84 response includes `renewInSec`. Renew before it expires rather than re-solving the whole flow each time.

### Complete Example

For a full working implementation with proper TLS client setup, header ordering, and cookie handling, see our examples repository:

{% embed url="<https://github.com/Hyper-Solutions/hypersolutions-examples>" %}