Skip to content
nsin docs
EN فا

Bot score distribution

GET
/analytics/security/bot-scores
 
curl --request GET \
  --url 'https://api.nsin.ir/analytics/security/bot-scores?domain=example.com&period=1h' \
  --header 'Authorization: Bearer <token>'

Requests per bot score bucket (bucket 0 = scores 1–9, … 9 = 90–99; 1 = bot, 99 = human-like), how many scored under 30 (low, low_share), and the JA4H fingerprints and networks most common under 30 (last 24h at most).

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Query Parameters

Section titled “Query Parameters ”
domain
required
string

The domain name (for example example.com). These endpoints take the domain as a query parameter rather than a path segment.

Example 
example.com
period
string
default: 24h
Allowed values: 1h 3h 6h 12h 24h 48h 7d 30d

Time window, ending now. Time series are bucketed by minute for 1h, by hour up to 48h, and by day for 7d and 30d. Buckets are cut on Asia/Tehran (UTC+03:30) boundaries and emitted as UTC instants, so an hourly bucket starts at :30 UTC. An unrecognised value falls back to 24h.

Responses

Section titled “ Responses ”

200

Section titled “200 ”

The figures.

Media type application/json
object
available
boolean
buckets
Array<object>
object
bucket
integer
from
integer
to
integer
count
integer
scored
integer
low
integer
low_share
number
top_ja4h
Array<object>
object
value
string
count
integer
top_asn
Array<object>
object
asn
integer
org
string
count
integer
Example generated
{
  "available": true,
  "buckets": [
    {
      "bucket": 1,
      "from": 1,
      "to": 1,
      "count": 1
    }
  ],
  "scored": 1,
  "low": 1,
  "low_share": 1,
  "top_ja4h": [
    {
      "value": "example",
      "count": 1
    }
  ],
  "top_asn": [
    {
      "asn": 1,
      "org": "example",
      "count": 1
    }
  ]
}

400

Section titled “400 ”

The domain query parameter is missing.

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example missing 
{
  "error": "domain is required"
}

401

Section titled “401 ”

Missing, malformed, revoked or expired API key. (A valid key whose account has been deactivated gets 403 account is inactive instead.)

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example invalidKey 
{
  "error": "invalid API key"
}

402

Section titled “402 ”

The domain has no active plan at all, so no plan feature is available on it. Buy or renew a plan for the domain. (A plan that is active but does not include the feature answers 403 instead.)

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example noPlan 
{
  "error": "This domain does not have an active plan."
}

403

Section titled “403 ”

The domain’s plan does not include the feature this endpoint needs (monitoring for most sections, logs for raw and top-N request data).

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Example 
{
  "error": "read-only API key"
}

404

Section titled “404 ”

No such domain, or it is not visible to this account. Domains you cannot access are reported as not found rather than forbidden.

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Example 
{
  "error": "read-only API key"
}

429

Section titled “429 ”

The key exceeded its request budget (300 requests per minute by default).

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example limited 
{
  "error": "rate limit exceeded"
}

503

Section titled “503 ”

Either the analytics backend is temporarily unreachable (retry; no data is lost), or the answer is still being computed. The per-domain sections and the cached account-wide views (domains-overview, global-summary, global-summary/peak, requests-compare, bandwidth-overview, nodes-overview) wait at most about 25 seconds for their query; past that they answer 503 with pending: true and a Retry-After header, while the query keeps running and caches its result, so the retry is served from that cache instead of starting the same scan again. Identical concurrent requests share one computation.

Media type application/json
object
error
required

Human-readable description of what went wrong.

string
pending

true when the query is still running rather than failing. Retry after Retry-After seconds.

boolean
Examples
{
  "error": "analytics unavailable"
}

Headers

Section titled “Headers ”
Retry-After
integer
Example 
5

Seconds to wait before retrying. Sent only with pending.

504

Section titled “504 ”

The query ran out of time for this period. Retrying the same request runs the same query again, so ask for a shorter period (or narrow it with hostname/path) instead.

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example timedOut 
{
  "error": "summary timed out for this period; try a shorter one"
}