> For the complete documentation index, see [llms.txt](https://docs.hypersolutions.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hypersolutions.co/incapsula/utmvc.md).

# UTMVC

A site is using UTMVC when its HTML loads an `/_Incapsula_Resource?SWJIYLWA=...` script. The flow is: fetch that script, generate a cookie from it via our API, set the `___utmvc` cookie, then hit a submit path to activate it.

{% hint style="info" %}
The cookie name is **`___utmvc`**, three underscores.
{% endhint %}

#### Implementation Steps

**Step 1: Parse the script path**

Extract the UTMVC script path from the page HTML. You can use the regex below, or the SDK helper (`ParseUtmvcScriptPath` in Go, `parse_utmvc_script_path` in Python, `parseUtmvcScriptPath` in JS/TS):

```regex
src="(/_Incapsula_Resource\?[^"]*)"
```

**Step 2: Fetch the script content**

Make a GET request to the script path from Step 1 and store the full response body. Our API needs the script contents to generate a valid cookie.

**Step 3: Generate & set the cookie**

Generate the cookie via our API (`GenerateUtmvcCookie` / `generate_utmvc_cookie` / `generateUtmvcCookie`), then set the returned value as the `___utmvc` cookie in your jar. The input requires:

* **UserAgent**: the same Chrome User-Agent you use for every request.
* **SessionIds**: the value of **each** cookie whose name starts with `incap_ses_`.
* **Script**: the script body from Step 2.

{% hint style="success" %}
The request body is large, compress it (`gzip`, `br`, or `deflate`) and set the `content-encoding` header. The SDKs auto-compress bodies over 1000 bytes.
{% endhint %}

**Step 4: Submit to activate the cookie**

Make a GET request to the submit path to activate the cookie:

```
/_Incapsula_Resource?SWKMTFSR=1&e=<random>
```

`e` is a random 64-bit float (for example `0.14896897949050825`). The SDK helpers build this path for you: `GetUtmvcSubmitPath()` / `get_utmvc_submit_path()` / `generateUtmvcScriptPath()`. If the `___utmvc` cookie is valid, the server responds by setting the cookie to the value `"a"` with a max-age of 0.

**Step 5: Make your real requests**

With the `___utmvc` cookie in place, retry the request that was blocked.

#### Notes

* The `___utmvc` cookie name has three underscores, a common source of bugs.
* Use consistent headers, User-Agent, and TLS fingerprint across all requests.
* See the [API Reference](/api-reference/incapsula.md) if you want to call `/utmvc` directly instead of using an SDK.