Quickstart

1. Create a solve session

Send the full browser and page context on the first request:

curl --request POST \
  --url https://api.evade.now/solve \
  --header 'content-type: application/json' \
  --data '{
    "task_type": "shape",
    "proxy": "http://username:password@proxy.example:8080",
    "target_url": "https://www.southwest.com/air/booking/select-depart.html",
    "shape_js_url": "https://www.southwest.com/assets/app/scripts/swa-common.js",
    "target_api": "https://www.southwest.com/api/air-booking/v1/air-booking/page/air/booking/shopping",
    "target_api_method": "POST",
    "referer": "https://www.southwest.com/",
    "ua": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
  }'

The proxy must be an absolute http, https, socks4, or socks5 URL. It may include credentials in the URL.

The user agent must identify a browser supported by Evade and have a complete stored fingerprint. Submit it exactly as it will appear on the replay request.

2. Read the response

{
  "headers": {
    "Accept": "application/json",
    "Cookie": "session=...",
    "ksl6nwtyby-a": "...",
    "ksl6nwtyby-b": "..."
  },
  "user_agent": "Mozilla/5.0 ... Chrome/151.0.0.0 Safari/537.36",
  "session_id": "0123456789abcdef0123456789abcdef"
}

Save session_id if you need headers for follow-up API calls from the same page and challenge context.

3. Replay the request

Send the destination request through the same proxy. Copy every entry from headers, and use user_agent unchanged.

Do not merge the generated values into a different browser session. The proxy, cookies, user agent, destination URL, and method are part of the solved context.

4. Generate follow-up headers

Reuse the returned session with only the next destination request:

curl --request POST \
  --url https://api.evade.now/solve \
  --header 'content-type: application/json' \
  --data '{
    "task_type": "shape",
    "session_id": "0123456789abcdef0123456789abcdef",
    "target_api": "https://www.southwest.com/api/air-booking/v1/air-booking/page/air/booking/shopping",
    "target_api_method": "POST"
  }'

See session reuse for lifecycle and validation behavior.

Embedded interstitials

Some protected pages return the Shape VM directly inside a one-time interstitial instead of loading a separate shape_js_url. Send the page URL as both target_url and target_api, omit shape_js_url, and include the cookies from the browser session that reached the page:

curl --request POST \
  --url https://api.evade.now/solve \
  --header 'content-type: application/json' \
  --data '{
    "task_type": "shape",
    "proxy": "http://username:password@proxy.example:8080",
    "target_url": "https://shop.example/item/123",
    "target_api": "https://shop.example/item/123",
    "target_api_method": "GET",
    "cookies": {"authenticated_session": "opaque-browser-cookie"},
    "ua": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
  }'

The response has "one_time": true and no session_id. Replay all returned headers immediately, once, with a GET to the exact same URL through the same proxy. A repeated interstitial requires a fresh /solve request.

Get started

Guides

API reference

1. Create a solve session

2. Read the response

3. Replay the request

4. Generate follow-up headers

Embedded interstitials

​1. Create a solve session

​2. Read the response

​3. Replay the request

​4. Generate follow-up headers

​Embedded interstitials

1. Create a solve session

2. Read the response

3. Replay the request

4. Generate follow-up headers

Embedded interstitials