> ## Documentation Index
> Fetch the complete documentation index at: https://docs.evade.now/llms.txt
> Use this file to discover all available pages before exploring further.
# Generate headers
> Generate request headers for one protected API call.
Use a full request to create a new solve session, or provide an active
`session_id` to generate a follow-up header set from cached challenge state.
If the target page is a Shape interstitial, Evade discovers its embedded
one-time challenge automatically; omit `shape_js_url` and supply the browser
session's current cookies.
Replay the returned `headers` and `user_agent` unchanged through the same
proxy. Generate a new header set whenever the destination URL or method changes.
Interstitial responses contain `"one_time": true` instead of a `session_id`.
Replay them once as the same method and URL used in `target_url`.
## OpenAPI
````yaml openapi.yaml POST /solve
openapi: 3.1.0
info:
title: Evade API
version: 1.0.0
description: Generate request headers for Shape-protected API calls.
servers:
- url: https://api.evade.now
description: Production
security: []
paths:
/solve:
post:
summary: Generate headers
description: >
Creates a fresh solve session from a complete page and browser context,
solves a one-time challenge embedded in an interstitial page, or reuses
an active session for a follow-up protected request. Replay every
returned
header and the returned user agent through the same proxy.
operationId: generateHeaders
requestBody:
required: true
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/FreshSolveRequest'
- $ref: '#/components/schemas/SessionSolveRequest'
examples:
freshSolve:
summary: Start a solve session
value:
task_type: shape
proxy: http://username:password@proxy.example:8080
target_url: https://www.southwest.com/air/booking/select-depart.html
shape_js_url: https://www.southwest.com/assets/app/scripts/swa-common.js
target_api: >-
https://www.southwest.com/api/air-booking/v1/air-booking/page/air/booking/shopping
target_api_method: POST
referer: https://www.southwest.com/
ua: >-
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sessionSolve:
summary: Reuse an active session
value:
task_type: shape
session_id: 0123456789abcdef0123456789abcdef
target_api: >-
https://www.southwest.com/api/air-booking/v1/air-booking/page/air/booking/shopping
target_api_method: POST
interstitialSolve:
summary: Solve an embedded one-time interstitial
value:
task_type: shape
proxy: http://username:password@proxy.example:8080
target_url: https://shop.example/item/123
target_api: https://shop.example/item/123
target_api_method: GET
cookies:
authenticated_session: opaque-browser-cookie
ua: >-
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
responses:
'200':
description: Headers generated successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/SolveResponse'
examples:
success:
value:
headers:
Accept: application/json
Cookie: session=...
ksl6nwtyby-a: ...
ksl6nwtyby-b: ...
user_agent: Mozilla/5.0 ... Chrome/151.0.0.0 Safari/537.36
session_id: 0123456789abcdef0123456789abcdef
interstitial:
value:
headers:
ISTL-INFINITE-LOOP: '1'
Cookie: authenticated_session=...
generated-prefix-a: ...
user_agent: Mozilla/5.0 ... Chrome/151.0.0.0 Safari/537.36
one_time: true
'400':
description: The JSON body or one of its fields is invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
invalidURL:
value:
success: false
error:
code: invalid_request
message: 'target_api: must be an absolute HTTP(S) URL'
expiredSession:
value:
success: false
error:
code: invalid_request
message: 'session_id: does not identify an active solve session'
'408':
description: The client canceled the solve request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
success: false
error:
code: solve_canceled
message: context canceled
'502':
description: >-
The proxy, upstream site, fingerprint store, or challenge generation
failed.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
success: false
error:
code: solve_failed
message: upstream request failed
'504':
description: The solve exceeded the server deadline.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
success: false
error:
code: solve_timeout
message: context deadline exceeded
components:
schemas:
FreshSolveRequest:
type: object
additionalProperties: false
title: Fresh solve request
description: >-
Complete context required to start a reusable solve or solve a one-time
interstitial.
required:
- task_type
- proxy
- target_url
- target_api
- ua
properties:
task_type:
type: string
const: shape
description: Task discriminator. Must be `shape`.
proxy:
type: string
format: uri
description: >
Absolute proxy URL used for challenge generation and replay.
Supported
schemes are `http`, `https`, `socks4`, and `socks5`.
examples:
- http://username:password@proxy.example:8080
target_url:
type: string
format: uri
description: Absolute URL of the protected page that loads the challenge.
shape_js_url:
type: string
format: uri
description: |
Absolute URL of the Shape loader JavaScript. Optional when
`target_url` returns an embedded Shape interstitial; required when
the page has no embedded challenge.
target_api:
type: string
format: uri
description: Absolute destination URL of the protected API request.
target_api_method:
$ref: '#/components/schemas/TargetAPIMethod'
referer:
type: string
format: uri
description: Optional absolute referrer URL used while loading the page.
title:
type: string
description: >-
Optional page title. Evade extracts it from the target page when
omitted.
ua:
type: string
minLength: 1
description: >
Exact browser user agent used for fingerprint selection, challenge
execution, and replay. It must have a complete stored Evade
fingerprint.
cookies:
type: object
description: >
Optional current browser cookies installed before the target page is
fetched. Interstitials that require authentication need these
values.
Cookies are accepted only on a fresh solve and are scoped to
target_url.
additionalProperties:
type: string
debug:
type: boolean
default: false
description: Include session, challenge, generation, and timing diagnostics.
SessionSolveRequest:
type: object
additionalProperties: false
title: Session continuation request
description: >-
Minimal context required to generate follow-up headers from an active
session.
required:
- task_type
- session_id
- target_api
properties:
task_type:
type: string
const: shape
description: Task discriminator. Must be `shape`.
session_id:
type: string
pattern: ^[A-Za-z0-9_-]{32}$
description: Active session ID returned by a previous successful solve.
target_api:
type: string
format: uri
description: Absolute destination URL for this follow-up protected request.
target_api_method:
$ref: '#/components/schemas/TargetAPIMethod'
proxy:
type: string
format: uri
description: Optional. When supplied, it must exactly match the session proxy.
target_url:
type: string
format: uri
description: Optional. When supplied, it must exactly match the session page URL.
shape_js_url:
type: string
format: uri
description: >-
Optional. When supplied, it must exactly match the session loader
URL.
referer:
type: string
format: uri
description: Optional. When supplied, it must exactly match the session referrer.
title:
type: string
description: >-
Optional. When supplied, it must exactly match the session page
title.
ua:
type: string
description: >-
Optional. When supplied, it must exactly match the session user
agent.
debug:
type: boolean
default: false
description: Include session, challenge, generation, and timing diagnostics.
SolveResponse:
type: object
required:
- headers
- user_agent
properties:
headers:
type: object
description: Complete header set to apply to the protected request.
additionalProperties:
type: string
user_agent:
type: string
description: Exact browser user agent to use for the protected request.
session_id:
type: string
pattern: ^[A-Za-z0-9_-]{32}$
description: >-
Short-lived session ID for follow-up solves. Omitted for one-time
interstitial challenges.
one_time:
type: boolean
description: >-
True when the embedded challenge and returned headers can be
replayed only once. Such responses have no session_id.
session_reused:
type: boolean
description: >-
Whether cached session state generated this result. Returned only in
debug mode when true.
loader_url:
type: string
format: uri
description: Resolved Shape loader URL. Returned only in debug mode.
vm_url:
type: string
format: uri
description: Resolved Shape VM URL. Returned only in debug mode.
generation_mode:
type: string
description: Header generation strategy. Returned only in debug mode.
timing:
allOf:
- $ref: '#/components/schemas/SolveTiming'
description: Solve timing diagnostics. Returned only in debug mode.
ErrorResponse:
type: object
required:
- success
- error
properties:
success:
type: boolean
const: false
error:
type: object
required:
- code
- message
properties:
code:
type: string
enum:
- invalid_request
- solve_canceled
- solve_failed
- solve_timeout
message:
type: string
TargetAPIMethod:
type: string
enum:
- GET
- POST
default: GET
description: HTTP method of the protected destination request.
SolveTiming:
type: object
required:
- regional_ms
- build_ms
- generate_ms
- total_ms
- generation
properties:
session_lookup_ms:
type: integer
format: int64
description: Session lookup time for a continuation solve.
regional_ms:
type: integer
format: int64
description: Proxy regional-context lookup time.
fingerprint_ms:
type: integer
format: int64
description: Stored fingerprint selection time.
build_ms:
type: integer
format: int64
description: Challenge engine build time.
generate_ms:
type: integer
format: int64
description: Header generation time.
total_ms:
type: integer
format: int64
description: Total solve time.
generation:
$ref: '#/components/schemas/GenerationTiming'
GenerationTiming:
type: object
required:
- bootstrap_ms
- collection_ms
- warmup_ms
- protected_request_ms
- validation_ms
properties:
bootstrap_ms:
type: integer
format: int64
collection_ms:
type: integer
format: int64
warmup_ms:
type: integer
format: int64
protected_request_ms:
type: integer
format: int64
validation_ms:
type: integer
format: int64
patch_ms:
type: integer
format: int64
````