Skip to content
nsin nsin nsin Docs

List bot route rules

GET
/domains/{domain}/rules/bot-route/
 
curl --request GET \
  --url https://api.nsin.ir/domains/example.com/rules/bot-route/ \
  --header 'Authorization: Bearer <token>'

Acts on classified bot traffic — block it, serve alternative content, send it to a different origin, or just tag it in telemetry.

Returned in evaluation order. Requires domain.view.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
domain
required
string

The domain name (for example example.com) — not a numeric id.

Example 
example.com

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Bot route rules.

Media type application/json
Array
object
id
integer
domain_id
integer
record_id

Deprecated single-record scope. Prefer record_ids. Absent for zone-wide rules.

integer
record_ids

The proxied DNS records this rule applies to. Empty or absent means zone-wide — every proxied record of the domain.

Array<integer>
type
string
Allowed values: cache drop redirect rewrite waf captcha rate_limit bot_route origin_pool origin_route fingerprint error_page
enabled
boolean
priority

Evaluation order; lower runs first. Defaults to 100.

integer
host_pattern

Optional hostname filter. Empty means the rule is not host-scoped.

string
host_match_type

How host_pattern is matched. The empty string means “no host filter”, and is the only valid value when host_pattern is empty — the two fields are set and cleared together.

string
Allowed values: "" exact wildcard regex
action_mode
  • enforce — the rule acts (block, redirect, challenge, …).
  • dry_run — the rule matches and is logged as “would have acted”, but the request reaches the origin unchanged. Use it to test a rule safely.

Not every rule type honours this; cache ignores it.

string
Allowed values: enforce dry_run
created_at
string format: date-time
updated_at
string format: date-time
bot_kinds

Which bots this rule matches. Must not be empty.

Array<string>
Allowed values: * gptbot oai-searchbot chatgpt-user claudebot claude-user perplexitybot perplexity-user googlebot google-extended bingbot ccbot bytespider meta-externalagent amazonbot applebot duckduckbot yandexbot ahrefsbot semrushbot mj12bot generic-bot
require_verified

Only match bots whose identity was verified (by reverse DNS or published IP ranges), not merely self-declared in the user agent.

boolean
action
  • block — refuse the request.
  • alt_content — serve body with status instead of the origin.
  • alt_origin — proxy to alt_dest:alt_port over alt_scheme.
  • tag — let it through, but tag it in telemetry.
string
Allowed values: block alt_content alt_origin tag
status

Status code for alt_content.

integer
default: 200
body

Response body for alt_content.

string
alt_dest

Origin address for alt_origin.

string
alt_port

Origin port for alt_origin.

integer
alt_scheme

Scheme used to reach alt_dest.

string
Allowed values: http https
Example 
[
  {
    "type": "cache",
    "host_match_type": "",
    "action_mode": "enforce",
    "bot_kinds": [
      "*"
    ],
    "action": "block",
    "status": 200,
    "alt_scheme": "http"
  }
]

401

Section titled “401 ”

Missing, malformed, revoked or expired API key — or the owning account is inactive.

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example invalidKey 
{
  "error": "invalid API key"
}

404

Section titled “404 ”

No such domain, or your role on it does not permit this operation. The rules endpoints deliberately answer 404 rather than 403 for an insufficient role, so they never confirm that a domain exists to someone who cannot use it.

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example notFound 
{
  "error": "not found"
}

429

Section titled “429 ”

The key exceeded its request budget (300 requests per minute by default).

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example limited 
{
  "error": "rate limit exceeded"
}