Akamai SBSD and DataDome: Three Fields Become Required on 8 December

Over the last two months we added three fields as optional: context and scriptUrl on Akamai SBSD, and script on DataDome interstitial and slider. On 8 December 2026 all three become required. Requests without them will be rejected with a 400 that names the missing field.

This will not be a single switch. From 1 December a growing share of non-compliant requests gets the error, so you see it in your logs well before it applies to everything.

Key Takeaways

• Akamai SBSD scriptUrl is required on every SBSD call: the absolute src of the SBSD script tag, query included.
• Akamai SBSD context is required on every call after the first. The index field is removed. An empty context means a first call; anything after it chains from the context the previous response returned.
• DataDome interstitial and slider require the challenge script, as script or scriptHash, whenever the page loads it from a separate file. That is now all DataDome traffic we see.
• Errors ramp up: 10% of non-compliant requests on 1 December, 25% on 3 December, 50% on 5 December, 100% on 8 December.
• Starting today, a non-compliant request gets Sunset and X-Hyper-Deprecation response headers, so you can find every call that needs changing before anything fails.

#Why now

Each of these fields exists because the payload is wrong without it.

Without scriptUrl, the SBSD fingerprint falls back to default values for signals that a browser takes from the script itself, and those differ between a normal page and a block page. Without context, every SBSD call starts from scratch and re-sends around half a megabyte of script. Without the DataDome challenge script, we fall back to a pinned copy of a script that DataDome now serves as its own file, and the further it drifts from what the page actually loaded, the worse your success rate gets.

The fallbacks were there to give everyone time to migrate. They have done that job, and keeping them means keeping requests alive that are quietly getting worse results than they should.

#What to change: Akamai SBSD

You need Go v4, Python 4.0 or JS 5.0. These versions removed index and added scriptUrl. On Go the module path moves to /v4, so it is an import change as well as a version bump. Go /v2 and /v3 cannot send scriptUrl and will stop working on 8 December.

If you use hyper-sdk-playwright, upgrade to 1.0.0-beta.16 or later. It sends both fields for you.

First call: send the script and an empty context, plus scriptUrl. Keep the context from the response.

Every call after it: send that context, leave script empty, and keep sending scriptUrl.

res, err := session.GenerateSbsdData(ctx, &hyper.SbsdInput{
    // ...the fields you already send
    Script:    script,      // first call only
    Context:   lastContext, // empty on the first call
    ScriptUrl: "https://example.com/.well-known/sbsd?v=7ac10a5c-7a4e-fddd-611f-39dcf23f1722&t=99543528",
})
lastContext = res.Context

It is script_url= and context= in Python, and the matching constructor arguments of SbsdInput in JS.

A hard block (an SBSD POST with a t parameter) always starts a new chain: send the script and an empty context again, never a context from an earlier chain.

The context field guide and the SDK majors post have the full code for all three languages.

#What to change: DataDome interstitial and slider

You need Go v2.11, Python 2.13 or JS 3.1 or later, and the latest release of each is better, since it sends a 64 character scriptHash instead of the script body.

After you fetch the challenge page, ask the SDK for the script URL, fetch it with the same client, and pass the body as script:

var script string
if scriptURL, ok := datadome.ParseChallengeScriptURL(html); ok {
    // GET scriptURL with the same client, read the body into script
}

res, err := session.GenerateDataDomeInterstitial(ctx, &hyper.DataDomeInterstitialInput{
    // ...the fields you already send
    Script: script,
})

A page that still inlines the script needs nothing extra and will not be rejected. The challenge script guide covers detection and fetching in all three languages.

#Timeline

• 9 to 30 November: nothing is rejected. Non-compliant requests get deprecation headers only.
• 1 December: 10% of non-compliant requests are rejected.
• 3 December: 25%.
• 5 December: 50%.
• 8 December: 100%. The fields are required.

Each request is picked independently, so during the ramp every affected integration sees some errors early, not only an unlucky few.

#How to check you are ready

Every response to a non-compliant request now carries these headers:

Sunset: Tue, 08 Dec 2026 00:00:00 GMT
Link: <https://hypersolutions.co/blog/sbsd-datadome-required-fields>; rel="sunset"
X-Hyper-Deprecation: missing scriptUrl: send the absolute src of the SBSD script tag on every call, ...

A compliant request gets none of them. Log X-Hyper-Deprecation for a day; if it never shows up, you are done.

We are also tracking which accounts still send non-compliant requests. If yours does, you will get a reminder email every week until it stops.

#If a request gets rejected

The 400 body names the missing field and links back here. Rejected requests are not billed. During the ramp, retrying the same request can succeed, but treat the error as the signal to migrate, not as something to retry around: on 8 December every retry fails too.

#On making fields required at all

We know this means touching code that works, redeploying, and re-verifying a flow. We gave each field time as optional first, and we are ramping errors instead of flipping a switch so nothing breaks without warning.

If anything is unclear, or a capture of yours does not match what this post describes, come and ask us in Discord. We are happy to look at it.