Skip to main content

Akamai SBSD sensor data API

Akamai SBSD uses many sophisticated techniques to identify and block automated traffic. Our API takes care of heavy lifting for you, leaving you to focus on your use case instead of worrying about bot detection. It's often used in conjunction with Akamai Web V3.

warning

We do not support illicit use of our API, and we will not hesitate to block any users who abuse it. We are committed to providing a safe and secure experience for all of our users, and we will take action against anyone who violates our terms of service. Unblocking may only be possible after ID KYC verification and/or valid justification.

Getting started​

To confirm whether a website uses Akamai Web SBSD, you have to check for the presence of the bm_so/sbsd_o cookie (later called just bm_so for simplicity). It's what governs the authenticity of the session. In order to obtain a valid bm_so cookie, you have to send a POST request to the SBSD endpoint.

The flow is different depending on SBSD variant.
Thankfully variants can be easily distinguished by presence of t parameter in the script URL, which is present in challenge flow and absent in non-challenge flow.

Normal flow appears on normal unblocked responses, whereas challenge flow appears on blocked responses, which contain no real page content.

Example of challenge flow response:​

<!DOCTYPE html>
<html lang="en">
<body><script type="text/javascript" src="/oh9-FCgd0/yhU7kLks/Ff0U2kh_/4s/Xz9OG03zOm9L/Hkg8dEgB/bGR/NdH5kJmR8?v=78225c20-0424-cb9d-3fba-9216b7e617d0&amp;t=939508737"></script>
<script>
    (function() {
        var chlgeId = '';
        var scripts = document.getElementsByTagName('script');
        for (var i = 0; i < scripts.length; i++) {
            if (scripts[i].src && scripts[i].src.match(/t=([^&#]*)/)) {
                chlgeId = scripts[i].src.match(/t=([^&#]*)/)[1];
            }
        }
        var proxied = window.XMLHttpRequest.prototype.send;
        window.XMLHttpRequest.prototype.send = function() {
            var pointer = this
            var intervalId = window.setInterval(function() {
                if (pointer.readyState === 4 && pointer.responseURL && pointer.responseURL.indexOf('t=' + chlgeId) > -1) {
                    if (window.self === window.top) {
                        location.reload(true);
                    }
                    clearInterval(intervalId);
                }
            }, 1);
            return proxied.apply(this, [].slice.call(arguments));
        };
    })();
</script>
</html>

There are only 2 distinct flows:

1. Challenge flow (with t parameter)​

Please visit challenge flow page for more information.

2. Normal flow (without t parameter)​

Please visit normal flow page for more information.