429 Too Many Requests is usually not about rate. It is Akamai challenging the request and asking for an SBSD payload before it will answer. Solve the challenge once, then retry the request that was refused.
This page assumes you know the passive flow on the SBSD page. The steps are the same; the differences are the token, a single payload instead of two, and the success check.
How to recognize it
Either of these means you are being challenged:- A request returns
429with a small JSON body containing a token:{"t": "259288945"}. - A page response contains the SBSD script tag with a
tparameter in its query string, in addition to the usualv:
t value is the challenge token. You need it, the visitor id and the SBSD cookie, exactly as in the passive flow.
The flow
1
Read the token, the visitor id and the cookie
When the 429 body is a page, its SBSD script tag carries the path,
v and t together; read all three from it. When the body is the small JSON object, take t from it and reuse the path and v from the SBSD script you saw on the page before. Take sbsd_o, bm_so or bm_o from the jar.2
Generate one payload
Call
/sbsd as in the passive flow with index: 0. A challenge takes a single payload, not the pair a page load takes.3
Post it with the token
Post to the script path with
?t=<token> appended, as JSON with the payload under body, through the same session.4
Check the cookie
The response sets a cookie named
bm_sc, sbsd_sc or sbsd_c. Its value starts with 2 when the challenge is passed. Any other first character means the payload was refused.5
Retry the original request
Send the request that got the 429 again, unchanged, through the same session. It should now return the real content.
Troubleshooting
The site returns another 429 straight after a successful solve
The site returns another 429 straight after a successful solve
Do not loop. One solve per challenge; if the same session is challenged again immediately, the IP or the session is flagged. Start a fresh session on a fresh sticky proxy.
There is no t in the 429 body
There is no t in the 429 body
Then it is a real rate limit or a block from another layer. Slow down and check the sensor flow before treating it as SBSD.