Agentscan
Agentscan API
Classify a request as human, known bot, AI agent or malicious automation.
Classify a request
Parameters
- ipstringRequired
Client IP as seen at your edge.
- user_agentstring
User-Agent header of the request.
- ja4string
JA4 TLS fingerprint of the client.
- headersobject
Request headers, for the consistency check.
- headless_flagsobject
Automation tells collected in the browser, such as webdriver.
- request_idstring
Your own id for the request, kept with the verdict.
Response fields
- classstring
human, known_bot, ai_agent or malicious_automation.
- confidencenumber
Confidence from 0 to 1.
- actionstring
Recommended action: allow, flag or block.
- signalsobject
The evidence behind the verdict, keyed by signal.
curl -X POST https://ipscanner.io/v1/agentscan/check \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"ip": "203.0.113.7",
"user_agent": "Mozilla/5.0 (X11; Linux x86_64) HeadlessChrome/126.0.0.0",
"ja4": "t13d1516h2_8daaf6152771_02713d6af862",
"headers": {
"accept-language": "en-US"
}
}'{
"class": "malicious_automation",
"confidence": 0.91,
"action": "block",
"signals": {
"network_origin": "datacenter",
"anonymized": false,
"headless": true,
"header_consistency": "mismatch",
"allowlist_verified": false,
"ja4": "t13d1516h2_8daaf6152771_02713d6af862"
}
}Classify log lines
Parameters
- linesobject[]Required
Up to 25,000 parsed log lines, each with a line number and ip.
Response fields
- submittedinteger
Items received.
- processedinteger
Lines classified.
- failedinteger
Lines that could not be classified.
- truncatedboolean
True when the run stopped before the end.
- byClassobject
Count of results per class.
- resultsarray
One verdict or error per line.
curl -X POST https://ipscanner.io/v1/agentscan/batch \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"lines": [
{
"line": 1,
"ip": "66.249.66.1",
"user_agent": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
},
{
"line": 2,
"ip": "203.0.113.7",
"user_agent": "python-requests/2.32.3"
}
]
}'{
"submitted": 2,
"processed": 2,
"failed": 0,
"truncated": false,
"reason": "",
"byClass": {
"known_bot": 1,
"malicious_automation": 1
},
"results": [
{
"line": 1,
"ip": "66.249.66.1",
"class": "known_bot",
"confidence": 0.99,
"action": "allow"
},
{
"line": 2,
"ip": "203.0.113.7",
"class": "malicious_automation",
"confidence": 0.84,
"action": "block"
}
],
"asOf": "2026-10-06T14:05:00Z"
}Verify a crawler
Parameters
- ipstringRequired
IP the crawler request came from.
- botstring
Crawler slug to verify against, such as googlebot.
- user_agentstring
User-Agent to verify instead of a bot slug.
Response fields
- outcomestring
verified, spoofed or unverifiable.
- methodstring
How the crawler is verified, such as ip-list+reverse-dns.
- crawlerstring
Display name of the crawler.
- summarystring
One-sentence result of the check.
- checksarray
Each check that was run, with its status.
- hostnamestring
Reverse DNS name of the IP.
- checkedAtstring
When the check ran.
curl -X POST https://ipscanner.io/v1/agentscan/verify \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"ip":"66.249.66.1","bot":"googlebot"}'{
"ip": "66.249.66.1",
"slug": "googlebot",
"crawler": "Googlebot",
"outcome": "verified",
"method": "ip-list+reverse-dns",
"summary": "Address is in Google's published Googlebot ranges and reverse DNS confirms it.",
"checks": [
{
"name": "published_range",
"status": "pass",
"detail": "66.249.66.0/27"
},
{
"name": "reverse_dns",
"status": "pass",
"detail": "crawl-66-249-66-1.googlebot.com"
}
],
"networkOrigin": "hosting",
"anonymized": false,
"asn": "AS15169",
"asnName": "GOOGLE",
"country": "US",
"hostname": "crawl-66-249-66-1.googlebot.com",
"docs": "https://developers.google.com/search/docs/crawling-indexing/verifying-googlebot",
"checkedAt": "2026-10-06T14:05:00Z"
}List the allowlist
Response fields
- agents[].identstring
Crawler or agent identifier.
- agents[].typestring
search, ai_crawler or partner.
- agents[].verificationMethodstring
How a request is matched to this entry.
- agents[].customerIdinteger | null
Your account id for entries you added; null for global ones.
curl https://ipscanner.io/v1/agentscan/allowlist \
-H "Authorization: Bearer YOUR_API_KEY"{
"agents": [
{
"id": 1,
"ident": "googlebot",
"type": "search",
"verificationMethod": "reverse_dns:googlebot.com,google.com",
"customerId": null,
"createdAt": "2026-03-01T00:00:00Z"
},
{
"id": 42,
"ident": "partnerbot",
"type": "partner",
"verificationMethod": "ua_match",
"customerId": 17,
"createdAt": "2026-09-12T08:30:00Z"
}
]
}Classify your own connection
Parameters
- ipstring
Override the IP. Defaults to the caller.
- user_agentstring
User-Agent header of the request.
- headersobject
Request headers, for the consistency check.
- ja4string
JA4 TLS fingerprint of the client.
Response fields
- ipstring
IP address that was checked.
- ja4Sourcestring
Where the fingerprint came from: edge, client or unavailable.
- classstring
human, known_bot, ai_agent or malicious_automation.
- confidencenumber
Confidence from 0 to 1.
- actionstring
Recommended action: allow, flag or block.
- signalsobject
The evidence behind the verdict, keyed by signal.
- meteredboolean
Always false: self-checks cost no credits.
curl -X POST https://ipscanner.io/v1/agentscan/self \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{}'{
"ip": "203.0.113.42",
"userAgent": "curl/8.7.1",
"ja4": "t13d4907h2_0d8feac7bc37_7395dae3b2f3",
"ja4Source": "edge",
"class": "ai_agent",
"confidence": 0.62,
"action": "flag",
"signals": {
"network_origin": "residential_clean",
"headless": false,
"ai_ident": false
},
"metered": false,
"asOf": "2026-10-06T14:05:00Z"
}