Skip to main content
When we identify the AI agent, assistant, crawler or automation tool behind a session, we surface it in the API. The Agent Atlas lists every agent we can identify and how we detect each one.

Agent Atlas

Browse every agent we can identify, filter by type and detection method, and see a sample API response for each one.

​
AI agents and bot score

Bot score tells you how likely it is that a session is automated. Agent detection tells you which agent is driving the session.
  • Most sessions with an identified agent also have a high bot score.
  • There will be some cases where we can tell a session is automated without being able to name the agent behind it.

​
Agent intent

Agents differ in intent. Some work for a real person, such as an assistant booking a reservation at a restaurant. Others are more malicious and lean toward high risk. We name the agent so you have the flexibility to decide how to handle each type. For example, you might allow a trusted shopping assistant on checkout while blocking headless automation at account creation.

​
How we identify agents

There are three methods we use to detect AI agents.

​
What we look at

​
Agent types

​
What you see in the API

When we identify an agent, the session response includes its details:
  • id: a fixed label for the agent, such as meta_muse or chatgpt_agent. Use this in your rules.
  • name and provider: the agent’s display name and the company that runs it.
  • type: the agent type, as ai_agent, ai_assistant, ai_crawler, crawler, headless_automation or other.
  • detection_method: how we identified it, as signed, self_declared or inferred.
  • detection_signals: the combination of signals used for detection, from cryptographic, network, device and behavioral.
Full field details are in the Get Session and Authenticate references.

​
Using it in your rules

  • Build rules on the id, type and detection method. Names and providers can change when an agent rebrands.
  • Signed agents carry the strongest proof of identity. Inferred agents are a pattern match.
  • A few common setups:
    • Allow signed agents you trust, such as a partner’s shopping assistant, and review the rest.
    • Send inferred agents to manual review on sensitive steps, such as signups or payouts.
    • Block headless automation at account creation.

​
When an agent shows up

Sometimes we need to watch a session for a while before we can name the agent. A session can show no agent at first and an agent later on. Once we identify an agent, it stays on that session.
  • Agent Atlas: every agent we identify, with sample API responses
  • Bot: bot score and the signals behind it
  • Risk Signals: the other signals in the session response