Amazon WAF CAPTCHA API
EndCaptcha solves Amazon WAF CAPTCHA challenges through the same API used for image CAPTCHAs: you send the challenge details from the page, poll for the result, and receive a token that you then submit on the target page. Start from the API hub if you are new to the service, and see the API reference for the image CAPTCHA endpoints this page builds on.
Before integrating, read what an Amazon WAF challenge is and what the target page exposes.
How it works
- Send a POST request to http://api.endcaptcha.com/upload with your credentials, type=16 and a waf_params JSON payload.
- Read the CAPTCHA id from the upload response.
- Poll http://api.endcaptcha.com/poll/<CAPTCHA_ID> every 3 seconds until the token comes back.
- Submit the returned token on the target page.
POST parameters
- username - your EndCaptcha username.
- password - your EndCaptcha password.
- type - 16, the value that marks this as an Amazon WAF challenge.
- waf_params - a JSON string with the challenge details below.
waf_params fields
- sitekey - the Amazon WAF site key of the target site. It is the key value inside the script that renders the challenge.
- pageurl - the full URL of the page that shows the challenge, including its path: if the challenge is at https://example.com/register, send that address, not the domain root.
- iv - the value of the iv parameter found in the same script on the page.
- context - the value of the context parameter found in the same script on the page.
- proxy and proxytype - optional but recommended, HTTP proxies only. A proxy keeps the address that solves the challenge and the address that submits the form consistent, which avoids rejections by the page.
{
"sitekey": "AQIDAHjcYu/GjX+QlghicBgQ/7bFaQZ+m5F...",
"pageurl": "https://example.com/register",
"iv": "the iv parameter from the page script",
"context": "the context parameter from the page script",
"proxy": "http://user:[email protected]:3128",
"proxytype": "HTTP"
}
Response
The polling call answers with the token when the challenge is solved. Until then it answers ? while a solver is working on it or UNSOLVED_YET while it waits in queue. The token is valid for a single use and expires in about two minutes. Submit it where the page expects it, next to the challenge the token belongs to.
Example
import json
from endcaptcha import HttpClient
client = HttpClient('YOUR_USERNAME', 'YOUR_PASSWORD')
payload = json.dumps({
'sitekey': 'AQIDAHjcYu/GjX+QlghicBgQ/7bFaQZ+m5F...',
'pageurl': 'https://example.com/register',
'iv': 'iv-from-the-page',
'context': 'context-from-the-page',
})
captcha = client.decode(type=16, waf_params=payload)
if captcha.get('text'):
print('WAF token: %s' % captcha.get('text'))
The same flow works in the official clients shipped from the API documentation page.
Amazon WAF API FAQ
Where do I find the site key, iv and context?
All three come from the script that renders the challenge on the page:
the key parameter of that script, and its iv and context parameters.
Which proxy types are supported?
HTTP proxies only, and only when you send them with the payload.
What does a solved challenge cost?
It is charged in credits like every other CAPTCHA, and some types cost
more credits than others. The packages and their credit prices are on
the pricing block of the home page.
Do I pay for a challenge that solved incorrectly?
No. Report it from your account and it is not billed, as described in
the FAQ.
