# Roolink

> Roolink generates the sensor data and cookies that Akamai Bot Manager and Akamai BMP expect from a real browser or app, so your own HTTP client can complete protected flows without a browser.

- [Documentation](https://docs.roolink.io/index.md): Create an account and learn how to integrate Roolink.
- [Quickstart](https://docs.roolink.io/quickstart.md): Get a key, install the tools every integration needs, then pick the product for your target.
- [Identify the protection on a site](https://docs.roolink.io/identify-protection.md): Two minutes with a powhttp recording tells you whether a target is Akamai Web, Akamai BMP, or something Roolink does not cover, and which extra checks the site has switched on.
- [Set up your HTTP client](https://docs.roolink.io/http-client.md): The client that talks to the target site, configured once: Chrome's handshake, a sticky proxy, a cookie jar, and headers sent in the browser's order.
- [Capture requests with powhttp](https://docs.roolink.io/capture-requests.md): Record what Chrome really sends to your target, copy it, and prove your own client sends the same thing.
- [Supported browsers](https://docs.roolink.io/supported-browsers.md): Which User-Agents Roolink can build a payload for, and how to keep your client describing the same browser everywhere.
- [Troubleshoot a block](https://docs.roolink.io/troubleshoot.md): A site checks your connection, then your headers, then your identity, then your IP, and only then the payload. Find the first check you failed.
- [SDKs](https://docs.roolink.io/sdks.md): Official Python, Go and TypeScript libraries for calling Roolink, and how to call it without one.
- [Solve your first Akamai challenge](https://docs.roolink.io/akamai-web/quickstart.md): Go from an empty project to a valid cookie on a site protected by Akamai Bot Manager. About fifteen minutes.
- [Sensor data](https://docs.roolink.io/akamai-web/sensor-data.md): The core Akamai Web flow in depth: what the cookies mean, how the script rotates, when to post again, and what each field does.
- [SBSD](https://docs.roolink.io/akamai-web/sbsd.md): Akamai's second check. Recognize it, post the payload on every page load, and keep the sensor flow running behind it.
- [Solve an SBSD challenge](https://docs.roolink.io/akamai-web/sbsd-429.md): When an Akamai site answers 429 with a token, it is an SBSD challenge, not a rate limit. Solve it and retry.
- [Sec-CPT](https://docs.roolink.io/akamai-web/sec-cpt.md): Read the 428, solve the proof of work, respect the wait, submit the answers, and finish the clearance.
- [Pixel](https://docs.roolink.io/akamai-web/pixel.md): A fingerprinting request most Akamai sites include and few enforce. When to bother, and how to pass it when you must.
- [Make your first app request](https://docs.roolink.io/akamai-bmp/quickstart.md): Emulate one phone, get a sensor for it, and make a request the app's servers accept. About fifteen minutes.
- [Sessions](https://docs.roolink.io/akamai-bmp/sessions.md): A BMP session is one phone: its identity, its cookies, its IP and its handshake, kept together for as long as the app accepts it.
- [TLS profiles](https://docs.roolink.io/akamai-bmp/tls-profiles.md): Akamai BMP expects the TLS handshake of a real iOS or Android app. These are the profiles that produce it, in Python, Go and Node.
- [API reference](https://docs.roolink.io/api-reference/introduction.md): One key, one host per product, JSON in and out. What every Roolink endpoint has in common.
- [Generate sensor data](https://docs.roolink.io/api-reference/akamai-web/sensor.md): Generates the sensor payload that earns a valid `_abck` cookie. Send the page URL, your User-Agent, the current `_abck` and `bm_sz` cookies, the script URL and the `scriptData` from `/parse`. Post the returned `sensor` to the script URL on the site, then check the cookie for `~0~`. Set `stepper` to…
- [Parse script](https://docs.roolink.io/api-reference/akamai-web/parse.md): Extracts the values every sensor for a site needs from the site's Akamai script. Send the script body as text. The result stays valid until the site changes its script, so cache it and pass it to `/sensor` as `scriptData`.
- [Generate SBSD payload](https://docs.roolink.io/api-reference/akamai-web/sbsd.md): Generates an SBSD payload. Send the visitor id from the SBSD script URL's `v` parameter, the `sbsd_o`, `bm_so` or `bm_o` cookie value, your User-Agent, the page URL and your language. Post the returned `body` to the script path on the site. A page load takes two payloads, `index` 0 then 1. A 429 cha…
- [Solve Sec-CPT](https://docs.roolink.io/api-reference/akamai-web/sec-cpt.md): Solves a Sec-CPT challenge, the `428` response whose body contains `sec-cp-challenge`. Send the challenge fields as they arrived plus the `sec_cpt` cookie value. The response carries the `token` and the `answers` to submit to the site once the challenge's wait has passed.
- [Generate pixel data](https://docs.roolink.io/api-reference/akamai-web/pixel.md): Generates the pixel payload that earns the `ak_bmsc` cookie. Send the `bazadebezolkohpepadr` value and the hash from the pixel script. Post the returned body to the pixel endpoint on the site as a URL-encoded form. It is already encoded.
- [Generate BMP sensor](https://docs.roolink.io/api-reference/akamai-bmp/sensor.md): Generates a BMP sensor and returns the device it came from. Send the app key, the proxy the session will use and a language. Set `android` or `ipad` for those devices; the default is an iPhone. Pass `deviceId` on later calls to continue the same device.

## OpenAPI Specs

- [akamai-bmp](/api-reference/openapi/akamai-bmp.yaml)
- [akamai-web](/api-reference/openapi/akamai-web.yaml)
- [imperva](/api-reference/openapi/imperva.yaml)
- [kasada](/api-reference/openapi/kasada.yaml)