Bot Detector API

GET

Tell real users apart from scrapers and automated bots.

Bot Detector analyzes user agent strings to identify bots, crawlers, and automated software. It matches against a database of known bots and adds heuristics that catch automated clients not in the database, returning the bot's category, reputation and a composite risk score. Useful for security, analytics, and access control.

Try it — live request, no key required

Request

GETapi.apiverve.com/v1/botdetector?ua=Googlebot%2F2.1%20(%2Bhttp%3A%2F%2Fwww.google.com%2Fbot.html)

Query parameters

uastring

Verification

Format

No key required to try it. Get a key to use it in your app.

Example

{
  "status": "ok",
  "error": null,
  "data": {
    "userAgent": "Googlebot/2.1 (+http://www.google.com/bot.html)",
    "isBot": true,
    "bot": {
      "name": "Googlebot",
      "category": "search_engine",
      "url": "http://www.google.com/bot.html",
      "reputation": "trusted",
      "shouldBlock": false
    },
    "isAutomated": true,
    "verified": true,
    "riskScore": 0,
    "riskLevel": "low"
  }
}

About the Bot Detector API

A bot detection API for crawlers and scrapers. Bot Detector uses a comprehensive database of known bot and crawler user agent patterns to identify automated traffic, categorizing detected bots into types like search engines, social media crawlers, SEO tools, and monitoring services. It also applies list-free heuristics to flag automated clients the database misses — missing user agents and non-browser clients such as curl and scripts — and returns a composite risk score.

What people use it for

Analytics Filtering: Exclude bot traffic from your analytics to get accurate visitor metrics and user behavior data
Access Control: Implement different behavior for bots vs real users, such as rate limiting or content restrictions
Security Monitoring: Identify potentially malicious crawlers and scrapers attempting to access your content
SEO Insights: Track which search engine bots are crawling your site and how frequently

Ways to call it

One endpoint, many ways in — REST with JSON, XML, YAML and CSV, plus GraphQL and an MCP interface for AI agents.

JSON: Default REST response
XML: Markup format
YAML: Human-readable
CSV: Tabular export
GraphQL: Query language
MCP: For AI agents

View all integrations →

Other ways to use Bot Detector

Same data, same APIVerve account, same credit balance — one key works on all of them.

Give it to an AI agentConnect over MCP and your agent calls it as a native tool — Claude, Cursor, ChatGPT.on VerveKit Google Sheets or ExcelA =VERVE() formula fills a column — no script, no export, recalculates in place.on VerveSheets Ground an agent on itA cited, machine-checkable fact your model can't produce on its own.on VerveContext

Questions.

Common questions about the Bot Detector API.

Read the docs →

What types of automated traffic does it recognize?

It detects known crawlers across categories such as search engines, social media platforms, SEO tools, scrapers, and monitoring services. On paid plans, it also applies heuristic checks to catch non-browser tools, scripts, and command-line clients like curl that are not yet listed in the database.

What would 20,000 user agent checks a month cost me?

Starter covers exactly 20,000 checks each month for $29.99. Each check uses 10 credits, which works out to $1.50 per 1,000 checks or about $0.0015 per call. The Free plan includes 20 checks per month.

Do I get the risk score and bot category on the Free plan?

No, detailed bot metadata requires a paid plan. The Free plan only returns whether the string is a known bot. The composite risk score, risk level, automation flag, and specific bot details like name, category, reputation, and blocking advice unlock on Starter and above.

How often is the known bot database updated?

The database updates on a weekly basis to track newly identified crawlers and scraping tools. For uncataloged clients, paid plans pair database matching with list-free heuristics so zero-day automated traffic can still be flagged.

How does it handle non-browser clients or missing user agent strings?

On paid plans, heuristics automatically flag missing user agent strings and non-standard clients as automated. These requests register as automated traffic in the analysis, which raises the composite risk score even when no specific bot signature matches.

Request parameters — GET /v1/botdetector

Sent in the query string. Premium parameters are accepted on every plan but only take effect on plans that include them. Anything not listed here is dropped rather than passed through.

Required

Parameter	Type	Example	Description
`ua`Required	string	`Googlebot/2.1 (+http://www.google.com/bot.html)`	The user agent string to analyze (URL encoded)

Optional

Parameter	Type	Example	Description
`ip`Optional	string	`66.249.66.1`	Optional IP the request came from. When the user agent claims to be a Google, Bing, OpenAI or Apple crawler, it is checked against that operator's published IP ranges ip

Example request

1
2

curl "https://api.apiverve.com/v1/botdetector?ua=Googlebot%2F2.1%20(%2Bhttp%3A%2F%2Fwww.google.com%2Fbot.html)&ip=66.249.66.1" \
  -H "x-api-key: YOUR_API_KEY"

Authentication

Send your key in the x-api-key header. That is the only auth step — no token exchange, and no per-endpoint scope to configure.

Header	When	Value
`x-api-key`Required	Every request	Your API key. Header names are case-insensitive, so `X-API-Key` is the same header.
`Authorization`Alternate	Instead of the above	`Bearer <key>` — for clients that only expose bearer auth. Resolves to the same account and the same billing.

401 is the only auth verdict

A 401 means the key is missing, invalid or expired. A 403 means the key is valid but not permitted here — blocked by a key restriction or an IP allow-list. Running out of credits is a 429.

Response — GET /v1/botdetector

Every APIVerve endpoint returns the same three top-level keys, so one response handler covers your whole integration: status, error and data. Only data changes shape.

Sample response

{
  "status": "ok",
  "error": null,
  "data": {
    "userAgent": "Googlebot/2.1 (+http://www.google.com/bot.html)",
    "isBot": true,
    "bot": {
      "name": "Googlebot",
      "category": "search_engine",
      "url": "http://www.google.com/bot.html",
      "reputation": "trusted",
      "shouldBlock": false
    },
    "isAutomated": true,
    "verified": true,
    "riskScore": 0,
    "riskLevel": "low"
  }
}

Response fields

Paths are relative to data. Premium fields are absent rather than zeroed on plans that do not include them, so check for presence instead of comparing to 0.

Field	Type	Example	Description
`userAgent`	string	`"Googlebot/2.1 (+http://www.google.com/bot.html)"`	The analyzed user agent string provided in the request
`isBot`	boolean	`true`	Whether the user agent belongs to a known bot or crawler
`bot`Premium	object	`{...}`	Detailed bot information including name, category, and reputation
`name`Premium	string	`"Googlebot"`	Name of the detected bot or crawler
`category`Premium	string	`"search_engine"`	Category of bot: search_engine, social_media, monitoring, seo_tool, scraper, other
`url`Premium	string	`"http://www.google.com/bot.html"`	Official URL or documentation link for the bot
`reputation`Premium	string	`"trusted"`	Trust level: trusted (search engines, social), neutral (monitoring, SEO), malicious (scrapers, spam), or unknown
`shouldBlock`Premium	boolean	`false`	Recommendation whether to block this bot based on category and reputation
`isAutomated`Premium	boolean	`true`	Heuristic signal that the traffic is automated — true for known bots, missing user agents, and clients that do not present as a standard browser (e.g. curl, scripts, headless tooling). Catches automated clients not in the bot database
`verified`Premium	boolean	`true`	Whether a claimed Google, Bing, OpenAI or Apple crawler really comes from that operator's published IP ranges (false = spoofed). Null when no ip is given or the user agent claims no verifiable crawler
`riskScore`Premium	number	`0`	Composite 0-100 risk score combining bot reputation, block recommendation and automation heuristics (higher is riskier)
`riskLevel`Premium	string	`"low"`	Risk band derived from the score: low, medium or high

Response headers

Every response carries your balance, so your own code always knows where it stands without polling anything. All four are exposed to browsers through CORS.

Header	What it carries
`x-api-remaining-credits`	Credits left in the current cycle
`x-api-credits-used`	Credits spent in the current cycle
`x-api-max-credits`	The allowance for the cycle
`x-api-version`	Version of the endpoint that answered

Errors

Read the HTTP status first, then error for the specific reason. The body names the parameter that has to change.

Status	Meaning	What to do
`400`	Input was rejected	Read `error`; it names the parameter that has to change.
`401`	Key missing or invalid	Check the header name and the key value.
`403`	Key valid, but not permitted here	A key restriction or an IP allow-list — never a bad key.
`429`	Rate limited, or out of credits	Read `error` to tell them apart, then back off or top up.

What a call costs — 10 credits per call

Credits are shared across every APIVerve API — one balance, one key, one bill. Failed requests never count against it, so a rejected input costs nothing.

Plan	Per month	Credits	Bot Detector calls	Per 1,000 calls
Free	Free	200	20	Free
Starter	$29.99	200,000	20,000	$1.50
Pro	$99.99	1,000,000	100,000	$1.00
Mega	$299.99	4,000,000	400,000	$0.75

Calls are what the credits buy at this API's rate — spend them here, on any of the other APIs, or across both. Nothing is reserved per endpoint.

Compare all pricing tiers →

Call it from cURL — GET /v1/botdetector

No SDK to install — this is a plain HTTPS call to /v1/botdetector with your key in the x-api-key header. Swap in a real key and it runs as-is.

cURL

1
2

curl "https://api.apiverve.com/v1/botdetector" \
  -H "x-api-key: YOUR_API_KEY"

Resources

GitHubapiverve/botdetector-apiSource, issues and the examples this page is built from.ReferenceBot Detector API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/botdetectornpm apiverve-botdetectorPyPI APIVerve.API.BotDetectorNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Node.js — GET /v1/botdetector

Install the Node.js SDK, then call the Bot Detector API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — npm

npm install @apiverve/botdetector

Node.js

const res = await fetch("https://api.apiverve.com/v1/botdetector", {
  headers: { "x-api-key": "YOUR_API_KEY" },
});
const { data } = await res.json();
console.log(data);

Resources

npm@apiverve/botdetectorThe published Node.js client, versioned and signed.GitHubapiverve/botdetector-apiSource, issues and the examples this page is built from.ReferenceBot Detector API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

apiverve-botdetectorPyPI APIVerve.API.BotDetectorNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Python — GET /v1/botdetector

Install the Python SDK, then call the Bot Detector API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — PyPI

pip install apiverve-botdetector

Python

import requests

res = requests.get(
    "https://api.apiverve.com/v1/botdetector",
    headers={"x-api-key": "YOUR_API_KEY"},
)
print(res.json()["data"])

Resources

PyPIapiverve-botdetectorThe published Python client, versioned and signed.GitHubapiverve/botdetector-apiSource, issues and the examples this page is built from.ReferenceBot Detector API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/botdetectornpm APIVerve.API.BotDetectorNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from C# / .NET — GET /v1/botdetector

Install the C# / .NET SDK, then call the Bot Detector API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — NuGet

dotnet add package APIVerve.API.BotDetector

C# / .NET

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("x-api-key", "YOUR_API_KEY");

var json = await client.GetStringAsync("https://api.apiverve.com/v1/botdetector");
Console.WriteLine(json);

Resources

NuGetAPIVerve.API.BotDetectorThe published C# / .NET client, versioned and signed.GitHubapiverve/botdetector-apiSource, issues and the examples this page is built from.ReferenceBot Detector API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/botdetectornpm apiverve-botdetectorPyPI

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Go — GET /v1/botdetector

No SDK to install — this is a plain HTTPS call to /v1/botdetector with your key in the x-api-key header. Swap in a real key and it runs as-is.

req, _ := http.NewRequest("GET", "https://api.apiverve.com/v1/botdetector", nil)
req.Header.Set("x-api-key", "YOUR_API_KEY")

res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))

Resources

Also published for

@apiverve/botdetectornpm apiverve-botdetectorPyPI APIVerve.API.BotDetectorNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from PHP — GET /v1/botdetector

No SDK to install — this is a plain HTTPS call to /v1/botdetector with your key in the x-api-key header. Swap in a real key and it runs as-is.

PHP

$ch = curl_init("https://api.apiverve.com/v1/botdetector");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-api-key: YOUR_API_KEY"]);

$response = curl_exec($ch);
echo $response;

Resources

Also published for

@apiverve/botdetectornpm apiverve-botdetectorPyPI APIVerve.API.BotDetectorNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Ruby — GET /v1/botdetector

No SDK to install — this is a plain HTTPS call to /v1/botdetector with your key in the x-api-key header. Swap in a real key and it runs as-is.

Ruby

require "net/http"

uri = URI("https://api.apiverve.com/v1/botdetector")
req = Net::HTTP::Get.new(uri)
req["x-api-key"] = "YOUR_API_KEY"

res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

Resources

Also published for

@apiverve/botdetectornpm apiverve-botdetectorPyPI APIVerve.API.BotDetectorNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

All articles →

Preventing Fake Signups: Registration Fraud GuideLearn how to stop bots and fraudsters while maintaining conversion rates for legitimate users.Read

What Your User Agent String RevealsEvery HTTP request announces who you are. Here's what's in that string and what you can do with it.Read

7 SSL Certificate Problems That Kill TrustExpired certs, mismatched domains, weak encryption. A practical checklist for catching SSL issues before your users do.Read

Bot Detector API

Try it — live request, no key required

About the Bot Detector API

What people use it for

Ways to call it

Other ways to use Bot Detector

Questions.

Request parameters — GET /v1/botdetector

Required

Optional

Authentication

Response — GET /v1/botdetector

Response fields

Response headers

Errors

What a call costs — 10 credits per call

Call it from cURL — GET /v1/botdetector

Resources

Also published for

Call it from Node.js — GET /v1/botdetector

Resources

Also published for

Call it from Python — GET /v1/botdetector

Resources

Also published for

Call it from C# / .NET — GET /v1/botdetector

Resources

Also published for

Call it from Go — GET /v1/botdetector

Resources

Also published for

Call it from PHP — GET /v1/botdetector

Resources

Also published for

Call it from Ruby — GET /v1/botdetector

Resources

Also published for

Zero-code embed — one snippet, no backend

Changelog — Bot Detector API

Networking

Related articles

Ready to build with Bot Detector? Start with 200 free credits — one key unlocks all 300+ APIs.

Explore the catalog