"The requested URL was rejected. Please consult with your administrator. Your support ID is"

The page is two lines of plain text and a number. It looks like a server error, but a firewall wrote it, on purpose.

The page talks about an administrator because the firewall cannot tell a visitor from a colleague of the site. The administrator it means is the site's, not yours. Something in your request, or in the page the server tried to send back, broke a rule of the firewall. Very often it is not about you: an ordinary form, a pasted text or an old cookie is enough.

• Go back and try again in a simpler form: plain text in the field, no pasted formatting, no special characters. Those are the usual trigger.
• Clear the cookies of that site and reload. An oversized or outdated cookie is enough for a rejection.
• Try a private window or another browser, with extensions that rewrite pages or requests paused.
• Try another network, or turn the VPN off, in case the address is on a list.
• Copy the support ID and send it to the site's support with the time and what you were doing. Their administrator finds the exact rule by that number; nobody outside the site can read it.

For a script the same page has two possible causes, and they need different fixes.

• A rule about the request: a parameter, a header or a payload matched an attack signature or broke the policy. A browser sending the same request would be rejected too. Change the request.
• A rule about the client: with bot defense on, BIG-IP sends a JavaScript check to a client it has not seen, and rejects one that cannot pass it or that looks automated in its address, handshake or headers.
• The status hides it: the page comes with 200, so code that treats 200 as success stores the rejection as data. Search the body for the support ID line.
• The cookies expire: the TS cookies carry the result of the check, and the check is repeated when they run out.

The whole picture of the system is in the guide: Bypass F5 Bot Defense: Request Rejected.

Send the URL to the REST endpoint. With mode: "auto", the default, the first attempt is a browser-grade request from a residential IP. When the site answers with its JavaScript check, a real browser opens the page, lets it reload and returns what arrived.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

Read blocked rather than status: a rejection page served with 200 comes back with blocked: true. If the rejection is about the request itself, the same call is rejected again from any exit: change the request.

What the answer tells you

In the canary of 11 November 2026, all 6 calls to F5-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.