Task type
Imperva Incapsula reese84 solver API
Imperva Incapsula protects a site with a sensor script that posts browser data to a reese84 endpoint, and lets the session through only once it holds a valid reese84 token and the incap cookies. VoidCaptcha runs that reese84 challenge through your proxy and returns the token in solution.reese84 (also as solution.token) and the incap_ses_ and visid_incap_ cookies in solution.cookies, at $1.90 per 1,000 successful solves.
Imperva (formerly Incapsula) fronts a site with a sensor script that posts to a reese84 endpoint and sets a session token. Supply the reese84 URL taken from the page and you get two things back: the reese84 token in solution.token, and the incap cookie set — incap_ses_, visid_incap_ and friends — in solution.cookies. You need both. Presenting the token without the cookies puts you straight back on the sensor page.
Tip
task.type as IncapsulaToken and the solution arrives in solution.token, with solution.cookies and solution.reese84 beside it.A site that will not solve is worth telling us about — coverage is per target as much as per type. The quickest route is Telegram (@VoidCaptchaSupport), where someone usually answers within minutes. You can also open a ticket from your dashboard or email [email protected]. Send the URL and the site key either way.
Solve request#
Solving Imperva Incapsula is a single synchronous call. You post one task object and the response carries the finished solution — no task id to store, nothing to poll for.
The connection is held open for the whole solve. Set a client timeout that covers it — the default socket timeout in most HTTP libraries is shorter than the work. If holding a connection that long does not suit your worker fleet, the same task goes to /v1/createTask and you collect it from /v1/checkTask instead.
When to use it#
- Uptime checks against an Imperva-fronted portal
- Verifying a partner API still responds through the edge
- Compliance archiving of pages behind a session gate
Task object structure#
These fields go inside task. The envelope around it — clientKey and the optional softId — is the same for every type and is described in the API reference.
| Property | Type | Required | Description |
|---|---|---|---|
type | string | Required | Literal "IncapsulaToken". Matching is case-insensitive. |
url | string | Required | The page you are loading.e.g. https://example.com/account |
Incapsula_url | string | Required | The reese84 script the page loads: an async script on the site’s own domain whose path is a long random string. Not the page URL, and not /_Incapsula_Resource (that is the older ___utmvc challenge).e.g. https://example.com/Towardiant-Thou-Wals-Becommeth-Lady-Macb |
proxy | string | Required | Upstream proxy. Accepts host:port, host:port:user:pass, or a full http:// URL. Use a sticky session — a rotating exit IP mid-solve looks like a hijacked session and will fail.e.g. proxy.example.com:9090:user:pass |
user_agent | string | Optional | Pin the User-Agent used for the solve. Omit it and a coherent one is chosen for you and returned in the response — match whatever you send downstream.e.g. Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 … |
Example payload#
The whole body, assembled from the table above — copy it formatted to read, or on one line to paste straight into a terminal or a REST client. The values are placeholders: swap the key for your own and the URL and site key for the page you are solving.
https://api.voidcaptcha.com/v1/getResult{
"clientKey": "void_a1b2c3d4e5f60718293a4b5c6d7e8f90",
"task": {
"type": "IncapsulaToken",
"url": "https://example.com/account",
"Incapsula_url": "https://example.com/Towardiant-Thou-Wals-Becommeth-Lady-Macb",
"proxy": "proxy.example.com:9090:user:pass"
}
}Example request#
The smallest thing that gets a token back, in your language. Python and Node.js use the official client (pip install voidcaptcha, npm install voidcaptcha); every other language makes the HTTP call its standard library already has. The complete version, with the key read from the environment and the error envelope checked, is in Sample code at the bottom of this page.
Language choice is remembered across the whole site, so switching here carries to every other sample in the docs.
# pip install voidcaptcha
from voidcaptcha import VoidCaptcha
client = VoidCaptcha("void_a1b2c3d4e5f60718293a4b5c6d7e8f90")
result = client.incapsula(
url="https://example.com/account",
incapsula_url="https://example.com/Towardiant-Thou-Wals-Becommeth-Lady-Macb",
proxy="proxy.example.com:9090:user:pass",
)
print(result.value)Example response#
A successful solve returns errorId: 0 and a solution object. The result is in solution.token; alongside it is the userAgent the solve ran under.
solution carries those and nothing else — the gateway copies the result field, anything extra this type returns, and userAgent across, and drops the rest of whatever the solver sent. Timing arrives at the top level as elapsedMs, present only when the duration is known, beside cost and your remaining balance. The figures below are illustrative: nothing here is a published median.
This type also returns solution.cookies. The incap cookie set earned alongside the token, ready to send as a Cookie header. Only Imperva cookies are returned — the site's own application cookies are stripped.
This type also returns solution.reese84. The same token as solution.token, under Imperva’s own name for it. Both are always present and always equal; read whichever your code expects.
{
"errorId": 0,
"status": "ready",
"solution": {
"token": "03AGdBq25V6…",
"cookies": "incap_ses_1183_2745913=…; visid_incap_2745913=…",
"reese84": "…",
"userAgent": "Mozilla/5.0 …"
},
"cost": "$0.0019",
"balance": "$411.24",
"elapsedMs": 4820
}Send that userAgent on your downstream request as well — for the cookie-based types the result is bound to it and will be rejected under a different one.
Errors for this type#
The codes Imperva Incapsula can return, on top of the shared authentication and billing set. Branch on errorCode, not on the HTTP status.
| Code | HTTP | Meaning | Retry |
|---|---|---|---|
ERROR_KEY_MISSING | 401 | No clientKey was supplied. | Do not retry |
ERROR_KEY_INVALID | 401 | The key does not exist or has been revoked. | Do not retry |
ERROR_KEY_SUSPENDED | 403 | The account attached to this key is suspended. | Do not retry |
ERROR_TYPE_NOT_ENABLED | 403 | This account is not enabled for the requested task type. | Do not retry |
ERROR_INSUFFICIENT_BALANCE | 402 | Your balance will not cover this solve. | Do not retry |
ERROR_THREAD_LIMIT | 429 | You have more solves in flight than your key permits. | Retry with backoff |
ERROR_RATE_LIMITED | 429 | Too many requests in a short window. | Retry with backoff |
Every code, with the fix for each, is on the error reference. A failed solve is never charged.
Sample code#
A complete file: key from the environment, task built, error envelope checked, result used. It calls the endpoint directly rather than through an SDK, so it works as a starting point in any language.
import os
import sys
import requests
API = "https://api.voidcaptcha.com/v1/getResult"
payload = {
"clientKey": os.environ["VOIDCAPTCHA_KEY"],
"task": {
"type": "IncapsulaToken",
"url": "https://example.com/account",
"Incapsula_url": "https://example.com/Towardiant-Thou-Wals-Becommeth-Lady-Macb",
"proxy": "proxy.example.com:9090:user:pass"
},
}
# The endpoint is synchronous: it holds the connection open for the whole
# solve, so the read timeout has to cover it, not just the handshake.
res = requests.post(API, json=payload, timeout=180).json()
if res["errorId"] != 0:
sys.exit(f"{res['errorCode']}: {res['errorDescription']}")
solution = res["solution"]
# Carry the User-Agent downstream — the result was earned under it.
print(solution["token"])
print(solution["userAgent"])Questions#
What is reese84?
reese84 is the token Imperva’s sensor script earns after posting its browser data to the site’s reese84 endpoint. The site checks it, together with the incap cookies, before serving the page.
Do you solve the ___utmvc cookie?
Not today. IncapsulaToken solves the reese84 sensor challenge only. The older ___utmvc challenge, loaded from /_Incapsula_Resource, is not a supported task.
Which URL goes in Incapsula_url?
The reese84 script the page loads: an async script whose path is a long random string on the site’s own domain. It is not the page URL and not /_Incapsula_Resource.
Why do I need both the token and the cookies?
Imperva checks them together. Presenting the reese84 token without the incap cookies sends you straight back to the sensor page.
Do I need my own proxy?
Yes. The reese84 token is bound to the IP that earned it, so the solve runs through your proxy and you continue the session on the same one.
Last updated on 2 August 2026