Version 2.1.1792967583 · latest Download OpenAPI Markdown

Bot settings

Platform-wide bot management: the action per class (search engine / monitor and tool / automation tool / headless browser / malicious bot) and for fake crawlers, the challenge kind, behaviour score bands, protected endpoints and exceptions; admin only. Headless browser, malicious bot and fake crawler actions plus behaviour scoring belong to the paid feature WAF enhanced. Each site may override per class in the site config field bot.

bot-settingsProtectionAuthentication: Admin only2 endpoints

Get bot settings

GET/api/v2/bot-settings

Authentication: Admin only

Update bot settings

PUT/api/v2/bot-settings

Authentication: Admin only

Request body application/json

Field	Type	Required	Description
actions	object	—	Action per class; defaults are allow for search engines and monitors/tools, log for automation tools, challenge for headless browsers and block for malicious bots and fake crawlers. headless, malicious and fake belong to WAF enhanced.
challenge	string	—	Challenge kind used when the action is challenge - js (invisible), slide, rotate, click or captcha (default js). Values `["js","slide","rotate","click","captcha"]`
enabled	boolean	—	Master switch; false = no site does bot detection.
enhanced	string	—	WAF enhanced state - full (active), readonly (expired but within the read-only buffer, License.readonly_days, 7 days by default; enhanced items still work but are read-only) or basic (not purchased or past the buffer; headless browsers, malicious bots and fake crawlers are treated as ordinary visitors and not scored, settings kept); ignored on update. Values `["full","readonly","basic"]`
exceptions	object[]	—	Exceptions - matching requests skip bot detection (at least one of path, cidr and ja4; several in one entry must all match).
expected_updated_at	string	—	Optimistic lock - the updated_at as the caller read it (the version of the node.global config key, shared with CC and WAF settings; use 1970-01-01T00:00:00Z when the read value is null). If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check.
protect	string[]	—	Protected endpoints (path prefixes such as /login, WAF enhanced) - requesting them without loading a page first adds to the score.
score	object	—	Behaviour score bands (WAF enhanced, 0-100) - below js pass; js to slide invisible challenge; slide to block challenge by kind; from block act as a malicious bot. Requires js < slide < block. A visitor who passes a challenge scores 0 for 30 minutes.
updated_at	string	—	Version in the response (updated_at of the node.global config key; null if never changed); ignored on update.

Bot settings object

Field	Type	Required	Description
actions	object	—	Action per class; defaults are allow for search engines and monitors/tools, log for automation tools, challenge for headless browsers and block for malicious bots and fake crawlers. headless, malicious and fake belong to WAF enhanced.
challenge	string	—	Challenge kind used when the action is challenge - js (invisible), slide, rotate, click or captcha (default js). Values `["js","slide","rotate","click","captcha"]`
enabled	boolean	—	Master switch; false = no site does bot detection.
enhanced	string	—	WAF enhanced state - full (active), readonly (expired but within the read-only buffer, License.readonly_days, 7 days by default; enhanced items still work but are read-only) or basic (not purchased or past the buffer; headless browsers, malicious bots and fake crawlers are treated as ordinary visitors and not scored, settings kept); ignored on update. read-onlyValues `["full","readonly","basic"]`
exceptions	object[]	—	Exceptions - matching requests skip bot detection (at least one of path, cidr and ja4; several in one entry must all match).
expected_updated_at	string	—	Optimistic lock - the updated_at as the caller read it (the version of the node.global config key, shared with CC and WAF settings; use 1970-01-01T00:00:00Z when the read value is null). If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check.
protect	string[]	—	Protected endpoints (path prefixes such as /login, WAF enhanced) - requesting them without loading a page first adds to the score.
score	object	—	Behaviour score bands (WAF enhanced, 0-100) - below js pass; js to slide invisible challenge; slide to block challenge by kind; from block act as a malicious bot. Requires js < slide < block. A visitor who passes a challenge scores 0 for 30 minutes.
updated_at	string	—	Version in the response (updated_at of the node.global config key; null if never changed); ignored on update. read-only