Access Denied: "You don't have permission to access ... on this server"

The page is plain black text on white, and it is the same on every site that Akamai delivers. The Reference line is the giveaway.

The page does not come from the site's own server. An Akamai edge server refused the request before the site saw it, because of the address you came from, the browser or app that asked, or your country. Nothing is wrong with your account.

• Reload once, then try another network: mobile data instead of Wi-Fi, or the VPN off. If the page opens, the first address was the reason.
• Use a normal window of an up-to-date browser with extensions paused. Tools that block scripts or change the browser's identity make a request look automated.
• Clear the cookies of that site and start again from its home page. The verdict on a browser is kept in a cookie, and clearing it starts the judgement again.
• If the site serves only some countries, you will see this page from abroad. That is a choice of the site.
• Copy the whole Reference line and send it to the site's support soon. Their team can translate it into the rule that fired, and the logs behind a reference are kept only for a short time.

Akamai judges the connection before any page loads, and it lets a site protect its paths one by one. A script usually fails at the first step.

• Before the first header is read: the address, the TLS handshake, the order of the HTTP/2 settings and of the headers. A client that says it is Chrome and connects like a script gets this page.
• After a page loads: a script reports what the browser is, and the verdict is kept in the _abck cookie. Without a valid one, the refusal returns.
• Path by path: many sites leave the home page open and guard search, product and price pages. A scraper that passes its own test on the home page fails where the data is.
• Reloading from the same client gets the same page. The reference changes; the reason does not.

The whole picture of the system is in the guide: Akamai Bot Manager Bypass for Web Scraping.

Send the URL you need, as it is, to the REST endpoint. With mode: "auto", the default, the first attempt is a browser-grade request from a residential IP. When the site wants more, a real browser opens the page and the call retries on a fresh exit.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

For a site that serves one country only, set country. For a flow that has to stay on one IP, such as a search followed by its result pages, add a session id to the call.

What the answer tells you

The canary of 11 November 2026 runs a fixed list of 27 protected targets, Akamai sites among them: 72 of 81 calls came back with the real page, with a median response of 4.1 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.