SBSD

SBSD is a second check some Akamai sites run alongside the sensor. It has its own script, its own cookies and its own payload. On most sites it is passive: the browser posts two SBSD payloads on every page load and nothing visibly blocks you until you skip them. Roolink generates the payload; you post it the way the browser would, then carry on with the sensor flow. Some sites also use SBSD as an active block, answering a request with 429 and a token. That variant has its own page: SBSD challenge (429).

How to recognize it

The page contains a second Akamai script tag whose query string carries a v parameter shaped like a UUID:

<script src="/rQ2v9Lk/Tp/8HcW1Zm/f3NxYd0K/aG7Bu/sE/4Vj?v=f96b0144-83cf-fd90-7200-553b2f046010"></script>

Two details matter:

The v value is the visitor id. Only a UUID-shaped v marks the SBSD script; other scripts with a v are ordinary cache-busted assets.
There is no t parameter. When a t is present, the site is challenging you and you are in the 429 flow instead.

Alongside the script, Akamai sets a cookie named sbsd_o, bm_so or bm_o. Whichever the site uses, its value goes into the request.

The flow

Run this on every page load, after the page request and before the sensor flow. Each page load takes two payloads, index 0 and index 1, posted one after the other.

Read the values from the page

From the script URL take the path and the v value. From the cookie jar take sbsd_o, bm_so or bm_o, whichever is set.

Generate and post two payloads

Call /sbsd with the visitor id, the cookie value, your User-Agent, the page URL, your Accept-Language and index: 0. Roolink returns a body string; post it as the next step shows. Then call /sbsd again with index: 1 and post that too. The /sbsd call is plain JSON over HTTPS, shown here with a small helper that posts JSON to Roolink with your key (see Without an SDK); send and post are the request helpers from the Quickstart.

o = site.cookies.get("sbsd_o") or site.cookies.get("bm_so") or site.cookies.get("bm_o")
for index in (0, 1):
    payload = requests.post("https://web.roolink.io/api/v1/sbsd",
        headers={"x-api-key": os.environ["ROOLINK_API_KEY"]},
        json={"vid": vid, "userAgent": UA, "bm_o": o, "url": PAGE, "language": "en-US", "index": index},
    ).json()["body"]
    send("POST", ORIGIN + script_path, SBSD_HEADERS, json.dumps({"body": payload}))

o := firstCookie(jar, page, "sbsd_o", "bm_so", "bm_o")
for index := 0; index <= 1; index++ {
    var res struct{ Body string `json:"body"` }
    json.Unmarshal(callRoolink("/sbsd", map[string]any{
        "vid": vid, "userAgent": ua, "bm_o": o, "url": page, "language": "en-US", "index": index,
    }), &res)
    post(site, origin+scriptPath, sbsdHeaders(), `{"body":"`+res.Body+`"}`)
}

const o = (await cookie("sbsd_o")) || (await cookie("bm_so")) || (await cookie("bm_o"));
for (const index of [0, 1]) {
  const { body } = await roolinkPost("/sbsd", { vid, userAgent: UA, bm_o: o, url: PAGE, language: "en-US", index });
  await send("POST", ORIGIN + scriptPath, sbsdHeaders(), JSON.stringify({ body }));
}

How each post looks

Post each payload to the script path on the site, through the same session, with the page as referer. Send it as JSON with the payload under body, with application/json as the content type. Copy the rest of the headers from the browser’s SBSD post in your powhttp recording.

POST /rQ2v9Lk/Tp/8HcW1Zm/f3NxYd0K/aG7Bu/sE/4Vj HTTP/2
content-type: application/json
referer: https://www.example.com/product/123

{"body": "<payload from Roolink>"}

Continue with the sensor flow

The responses update the SBSD cookies. Keep them in the jar and move on to the sensor flow exactly as before. Repeat both posts on every new page load in the session.

Request fields

Field	Required	What it does
`vid`	yes	The `v` value from the SBSD script URL.
`userAgent`	yes	The User-Agent your session sends to the site.
`bm_o`	yes	The value of the `sbsd_o`, `bm_so` or `bm_o` cookie.
`url`	no	The page the script came from. Also used as the referer when posting.
`language`	no	Your `Accept-Language`, as a tag or the full header value.
`script_url`	no	The full SBSD script URL, if you have it.
`index`	yes	`0` for the first payload of a page load, `1` for the second. Leave it at `0` when answering a 429 challenge.

Troubleshooting

The next request after the post still gets blocked

Check the next response for a 429 with a t token. If it has one, the site has switched to the active variant; follow SBSD challenge (429). If not, the block is coming from the sensor layer or the connection, not from SBSD.

No sbsd_o, bm_so or bm_o cookie

I see the script but no v parameter

Then it is not the SBSD script. Look for the tag whose v is a UUID.

Get started

Products

How to recognize it

The flow

Request fields

Troubleshooting

​How to recognize it

​The flow

​Request fields

​Troubleshooting

How to recognize it

The flow

Request fields

Troubleshooting