For the complete documentation index, see llms.txt. This page is also available as Markdown.
Getting started
Incapsula (now Imperva) guards enterprise sites with the reese84 sensor and the ___utmvc cookie. This page explains how the pieces fit together.
Incapsula, now Imperva, guards login, checkout, and API endpoints across enterprise sites. It fingerprints the runtime with reese84, gates access behind the ___utmvc cookie, and can escalate to a captcha when trust drops. Our Incapsula & Imperva Bypass API reproduces the reese84 and ___utmvc payloads from a single HTTP call, so you don't have to run the obfuscated challenge scripts in a browser.
reese84 vs UTMVC
These are two separate layers. Some sites use one, some use both:
reese84 is the core sensor: a signed JavaScript fingerprint payload posted back before the site issues a valid reese84 token. It comes in two forms:
Static (background sensor, no challenge page), see Reese84.
Dynamic (a "Pardon Our Interruption" page, often with a Proof of Work step), see Reese84 Dynamic.
UTMVC is a separate challenge layer: a rotating, obfuscated script that, when executed correctly, issues the ___utmvc cookie that authorizes the session. See UTMVC.
If trust is low, Incapsula can fall back to an hCaptcha or GeeTest challenge inside an iframe. Hyper Solutions does not solve those, see Incapsula Captcha Block.
Which protection does my site use?
UTMVC: the page loads a script that looks like this:
/_Incapsula_Resource?SWJIYLWA=...
reese84: the browser holds a cookie named reese84, or you see an x-d-token header on requests. If the site serves a "Pardon Our Interruption" page, it's the dynamic variant.
FAQ
My requests still get blocked even though the payload looks valid. The usual culprits are an IP mismatch (the ip you pass must match your egress IP, use a sticky proxy), a rotated User-Agent, or an unhandled UTMVC or captcha layer. See Core Requirements.
Do I need to solve the captcha? Only if the site escalates to one. Hyper Solutions handles reese84 and ___utmvc; captcha blocks require a third-party solver, see Incapsula Captcha Block.
How long is a token good for? The reese84 response includes renewInSec. Renew before it expires rather than re-solving the whole flow each time.
Complete Example
For a full working implementation with proper TLS client setup, header ordering, and cookie handling, see our examples repository:
