# Akamai Web Scraping: One Call per Page | QuantumProxies.io

Akamai web scraping with the Web Unlocker: send the product or search URL, get the page or a blocked flag with its block class. Residential and mobile exits.

## Akamai web scraping on the pages Bot Manager guards

**Web Unlocker · Akamai Bot Manager**

Akamai web scraping breaks on the pages that matter: search, product and price pages answer 403 Access Denied while the home page loads. The Web Unlocker requests the exact URL you need from a residential or mobile IP with a browser-grade client, opens a real browser when the site asks, and returns the page or a clear blocked flag.

Akamai sites are on the list our canary calls. The run of 11 November 2026 covered 27 protected pages, 3 times each: 72 of 81 calls returned the real page (88.9%), with a median of 4.1 s. [The list, the method and each run are on the status page](https://quantumproxies.io/web-unlocker/status)

## What an Akamai refusal looks like from the outside

Akamai serves the same plain page on thousands of sites. The status never varies; the words and the reference number are what identify it.

| Where to look | What an Akamai refusal shows |
| --- | --- |
| Status code | 403. Some sites answer nothing at all: the connection hangs until your client gives up. |
| Page text | "Access Denied. You don't have permission to access ... on this server.", followed by "Reference #18." and a long number. |
| Reference number | It identifies the edge server and the request for the site's own team. It does not tell you which rule matched, and two refusals for the same reason carry different numbers. |
| Error link | A link to errors.edgesuite.net that carries the same reference. |
| Cookies | _abck and bm_sz on the first answer, ak_bmsc on many sites. _abck holds the verdict on your client. |
| Challenge page | On some sites, a short page with a progress bar that reloads by itself after a few seconds. |

![What Akamai Bot Manager answers a script and what one QuantumProxies Web Unlocker call returns: on the left the 403 with the words Access Denied, a reference number and the errors.edgesuite.net mark, in the middle the refusal page that came back instead of the product page, on the right the answer one call later, with status 200, blocked false, the tier that served the page and the vendor named on a try that was blocked.](https://quantumproxies.io/images/web-unlocker/systems/akamai.webp?v=20261112)

The Akamai refusal as a script receives it, and the answer of one Web Unlocker call for the same URL.

## Why Akamai web scraping fails where the data is

Akamai runs on the edge servers that deliver the site, so it sees the connection itself. It decides in steps. Before any script runs it looks at the IP reputation, the TLS handshake and the order of the HTTP/2 settings and headers; a client that says Chrome and connects like a script is refused there. After a page loads, a script reports what the browser is and how it behaves, and the verdict is written into the _abck cookie.

The site owner chooses which paths are guarded. Many leave the home page open and protect search, product, price and checkout pages, where a missing or invalid _abck is refused. A scraper tested on the home page looks healthy and then fails on every URL it was built for.

## What the Web Unlocker does on an Akamai site

Send the URL you actually need, not the home page. The first attempt is a browser-grade request from a residential exit, which is what Akamai's first decision reads. When the site wants more, a real browser opens the page, and a refused attempt is retried from a fresh exit. tier_served tells you which tier produced the page.

While a session with the site is valid it is kept for your next calls, so the cookie work is not yours. For a flow that has to stay on one IP, such as a search followed by its result pages, add a session id to the call and the exit is held for the time you set.

## One call per Akamai-protected page

The example is Node.js with fetch and no dependency. The request body is the URL and a country; set the country to the market the site serves.

The answer is one JSON object. Log status, blocked and tier_served for every URL and you have your own success rate, site by site.

```
const res = await fetch("https://app.quantumproxies.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));
```

[Request fields, answer fields and errors in the API docs](https://quantumproxies.io/docs/#tag/Web-Unlocker)

### Fields to log on Akamai sites

| Field | What to expect |
| --- | --- |
| status | The status of the page that was served: 200 for the product or search page you asked for. |
| blocked | true when every attempt ended on Access Denied or on a check that was not cleared. body holds what the site sent. |
| blockClass | Usually fingerprint when Akamai refuses the client with Access Denied, js_challenge when it serves a check that a browser clears, timeout when the site never answered. |
| vendor | akamai. |
| tier_served | tls or browser, the tier that produced the answer. |
| attempts | Attempts across both tiers. attempt_log lists each one with its exit country and outcome. |
| cost | What the call moved in bytes and what that cost. |

## Reading a blocked answer from Akamai

The reference number in the body of a blocked answer is of use only to the site's own team. The values to keep are request_id and attempt_log from our answer: they are what our support asks for.

A page that is still refused after every attempt comes back flagged, with the reason in blockClass. On Akamai sites it is usually one of these.

- fingerprint: the client itself was judged automated. Leave mode on auto; the browser tier is the next step and the engine takes it for you
- js_challenge: a check that a browser clears. With mode tls it is returned as it is
- timeout: the site, or the exit, never answered. Retry, and raise timeout_ms if the page is heavy
- access_denied or geo: try the country the site sells in, then the mobile tier

## Sessions, countries and the pages behind a search

Three settings do most of the work on Akamai sites. The country, because a site may show another catalogue, or nothing, to visitors from elsewhere. A session id, when a result page only makes sense after the search that produced it. And timeout_ms, because a guarded page that needs the browser takes longer than a plain one: the default budget is 60 seconds and you can raise it to 120.

A POST, for example a search form, is sent exactly once and never retried, because an answer means the site already received it. Plan the retries of a POST in your own code.

## Akamai sites and plain proxies

If you already run real browsers and only the IP is the problem, ISP or residential proxies are the right tool. If the client is an HTTP library, the handshake is refused before a header is read, from any IP. Route those URLs through the Web Unlocker and keep the proxies for the rest.

## What the Web Unlocker will not do on an Akamai site

It does not log in, hold an account or complete a checkout. It fetches pages a visitor can open without signing in. Captchas that need a person are not solved; the call says blockClass captcha. Banking, payment and login-provider destinations are not served at all.

A page being reachable does not settle whether you may collect it. That depends on the terms of the site and on the law covering the data, with or without Akamai in front.

## Frequently Asked Questions

### Can the Web Unlocker scrape sites behind Akamai Bot Manager?

Yes, for public pages. Send the URL you need; the request leaves from a residential or mobile IP with a browser-grade client, and a real browser opens the page when the site asks for one. The JSON answer holds the page and says which tier served it, or reports blocked with the block class.

### Which page of an Akamai site should I test first?

The one you need. Akamai lets the site owner guard paths one by one, and many sites leave the home page open while search, product and price pages are refused. A test on the home page proves little. Send a real product or search URL and read blocked and tier_served in the answer.

### My call to an Akamai site times out. Is that a block?

It can be. Some Akamai sites do not answer a client they distrust and let the connection hang. The Web Unlocker reports that as blockClass timeout after its attempts. Retry, because the next call uses a fresh exit, and raise timeout_ms, up to 120000, when the page itself is heavy.

### Can I keep one IP for a search and its result pages?

Yes. Add a session id to the call, or the x-qp-session header on the proxy, and the same exit is kept for that session, from 3 to 1440 minutes. With a pinned session the exit cannot change, so a refused request gets one normal attempt and then the browser.

### Does it work on the JSON API of an Akamai site?

Yes. Send the API URL with the method, headers and body your own client would send. A GET is retried on fresh exits; a POST is sent once. Read blocked in the answer before you parse, since a refusal on an API path is still a 403 page with a reference number.

## Web Unlocker pages for other protection systems

- [Web Unlocker for Cloudflare](https://quantumproxies.io/web-unlocker/cloudflare)
- [Web Unlocker for DataDome](https://quantumproxies.io/web-unlocker/datadome)
- [Web Unlocker for PerimeterX (HUMAN)](https://quantumproxies.io/web-unlocker/perimeterx)
- [Web Unlocker for Kasada](https://quantumproxies.io/web-unlocker/kasada)
- [Web Unlocker for Imperva (Incapsula)](https://quantumproxies.io/web-unlocker/imperva)
- [Web Unlocker for F5 BIG-IP and Shape](https://quantumproxies.io/web-unlocker/f5)
- [Web Unlocker for AWS WAF](https://quantumproxies.io/web-unlocker/aws-waf)

## Sources

- [Akamai TechDocs: about bots](https://techdocs.akamai.com/cloud-security/docs/about-bots)
- [Akamai TechDocs: handle adversarial bots](https://techdocs.akamai.com/cloud-security/docs/handle-adversarial-bots)
- [Akamai TechDocs: translate an error reference string](https://techdocs.akamai.com/edge-diagnostics/docs/translate-error-string)
- [RFC 9110, section 15.5.4: 403 Forbidden](https://www.rfc-editor.org/rfc/rfc9110.html#section-15.5.4)
- [QuantumProxies.io API docs: Web Unlocker](https://quantumproxies.io/docs/#tag/Web-Unlocker)
- [Web Unlocker status page](https://quantumproxies.io/web-unlocker/status)

## Related

- [Residential Web Unlocker](https://quantumproxies.io/web-unlocker/residential)
- [Mobile Web Unlocker, for sites that refuse residential ranges](https://quantumproxies.io/web-unlocker/mobile)
- [Web Unlocker status and measured success rate](https://quantumproxies.io/web-unlocker/status)
- [Why Akamai Bot Manager blocks most proxy traffic](https://quantumproxies.io/blog/why-akamai-bot-manager-blocks-most-proxy-traffic-in-2026)
- [ISP proxies for a fixed identity under your own browser](https://quantumproxies.io/isp-proxies)
- [All Web Unlocker](https://quantumproxies.io/web-unlocker)