Start Here

Requirements

• Windows, macOS, or Linux
• Python 3.11 or newer
• Network access to the listed Imperva endpoints
• An Imperva API ID and key with read access to the selected accounts

Check Python

py --version

On macOS or Linux, use:

python3 --version

Installation

1. Install Python

Download Python from python.org. On Windows, enable Add Python to PATH.

2. Open a terminal in the extracted C3P0 folder

cd C:\path\to\C3P0-v1

3. Install requirements — Windows

py -m pip install --upgrade pip
py -m pip install --no-warn-script-location -r requirements.txt

macOS or Linux

python3 -m pip install --upgrade pip
python3 -m pip install --no-warn-script-location -r requirements.txt

--no-warn-script-location suppresses only warnings about optional package executables that are not on PATH. It does not suppress dependency, download, or permission failures.

Verify

py C3P0_v1.py --check

WebUI — easiest start

py C3P0_v1.py

C3P0 opens at http://127.0.0.1:33160. It is bound to the local computer and is not exposed to the network.

Alternate port or no automatic browser

py C3P0_v1.py --webui --port 33161
py C3P0_v1.py --webui --no-browser

CLI reports

py C3P0_v1.py --origin-report

py C3P0_v1.py --sni-report

Run both reports

py C3P0_v1.py --origin-report --sni-report

Limit account scope

py C3P0_v1.py --origin-report --sni-report --account-id 111111 --account-id 222222

Include all visible sites in SNI output

py C3P0_v1.py --sni-report --all-sites

Select SNI workers or output folder

py C3P0_v1.py --sni-report --workers 5
py C3P0_v1.py --origin-report --sni-report --output-dir customer-reports

Worker values 1–10 are supported. Five is recommended. A safe Origin sample is available with --origin-report --sample.

Credentials

The WebUI requests an API ID and key for every run. CLI mode uses the current terminal session’s C3P0_API_ID and C3P0_API_KEY, or securely prompts for missing values.

PowerShell session

$env:C3P0_API_ID="YOUR_API_ID"
$env:C3P0_API_KEY="YOUR_API_KEY"
py C3P0_v1.py --origin-report --sni-report

macOS or Linux session

export C3P0_API_ID="YOUR_API_ID"
export C3P0_API_KEY="YOUR_API_KEY"
python3 C3P0_v1.py --origin-report --sni-report

These variables are stored in the current terminal session, not in a file, and normally disappear when the terminal closes. To change customers, overwrite the same two variables before the next run. C3P0 ignores unnamed IMPERVA_API_ID and IMPERVA_API_KEY variables to reduce accidental use of stale credentials.

Output files

CLI output defaults to reports/:

• origin_connection_reuse.csv
• origin_connection_reuse.html
• sni_account_certificate_audit.csv
• sni_account_certificate_audit.html
• api_diagnostics.json

Customer-facing downloaded HTML reports omit C3P0 branding. Diagnostics combine shared discovery/delivery requests and SNI-specific requests into one collection.

How API requests run

1. Discover the parent account, subaccounts, and visible sites once.
2. Request every site’s delivery configuration once and cache it.
3. Generate Origin results from cached origin_connection_reuse.
4. Reuse cached support_non_sni_clients for SNI assessment.
5. Request only the additional certificate/SAN and CNAME-reuse endpoints required for qualifying SNI sites.

The reports do not duplicate delivery-configuration calls. SNI site work is concurrent, so diagnostics record those responses in completion order with timestamps.

Load protection, progress, and stopping

• Each individual HTTP request has a 30-second timeout. This is not a whole-report timeout.
• Request starts are paced to no more than five per second.
• HTTP 429, 502, 503, and 504 status responses use bounded retries and backoff.
• SNI concurrency is bounded and defaults to five workers.
• The total gauge shows planned work; the bar shows the active report phase.

Full Stop prevents new queued calls from starting. An already-active request may return or reach its 30-second timeout. HTTP 401/403 responses and Imperva response bodies reporting a disabled or invalid API key automatically open the same global circuit breaker.

Security notes

• C3P0 performs read-only API operations.
• No create, update, save, upload, enable/disable, PUT, PATCH, or DELETE operation exists.
• WebUI credentials are kept for the current process only.
• Credential headers are redacted in diagnostics.
• Downloaded customer reports do not contain credentials.
• The WebUI listens only on 127.0.0.1.
• API keys are never accepted as command-line arguments.
• Diagnostics may contain account metadata and should be reviewed before sharing.

Troubleshooting

Missing pandas or requests

py -m pip install --no-warn-script-location -r requirements.txt

Port 33160 is in use

py C3P0_v1.py --webui --port 33161

Authentication or permission error

Confirm the API ID/key pair and its read permission for the requested parent or subaccounts. Use API diagnostics to inspect redacted requests and responses.

Large audit appears slow

Requests are deliberately paced. Imperva throttling and temporary service responses may also activate backoff. Avoid increasing workers unless the account owner accepts the additional burst.

Maintenance commands

py C3P0_v1.py --test
py C3P0_v1.py --help

Package layout

• C3P0_v1.py — only supported launcher
• imperva_reports/ — internal API, collection, WebUI, and report modules
• imperva_reports/sni_engine.py — SNI, certificate, SAN, and CNAME assessment logic
• imperva_reports/sni_audit.py — shared discovery, progress, concurrency, cancellation, and diagnostics adapter
• requirements.txt — Python dependencies
• tests/ — regression tests
• VERSION and CHANGELOG.md — release information

Imperva API endpoint reference

All calls are read operations. Some Imperva list/status APIs use POST as their query method.