# Bot Management API

## Workers: BotManagement Interface

```typescript
interface BotManagement {
  score: number;              // 1-99 (Enterprise), 0 if not computed
  verifiedBot: boolean;       // Is verified bot
  staticResource: boolean;    // Serves static resource
  ja3Hash: string;            // JA3 fingerprint (Enterprise, HTTPS only)
  ja4: string;                // JA4 fingerprint (Enterprise, HTTPS only)
  jsDetection?: {
    passed: boolean;          // Passed JS detection (if enabled)
  };
  detectionIds: number[];     // Heuristic detection IDs
  corporateProxy?: boolean;   // From corporate proxy (Enterprise)
}

// Access via request.cf
export default {
  async fetch(request: Request): Promise<Response> {
    const cf = request.cf as any;
    const botMgmt = cf?.botManagement;
    
    if (!botMgmt) return fetch(request);
    if (botMgmt.verifiedBot) return fetch(request); // Allow verified bots
    if (botMgmt.score === 1) return new Response('Blocked', { status: 403 });
    if (botMgmt.score < 30) return new Response('Challenge required', { status: 429 });
    
    return fetch(request);
  }
};
```

## WAF Fields Reference

```txt
# Score fields
cf.bot_management.score                    # 0-99 (0 = not computed)
cf.bot_management.verified_bot             # boolean
cf.bot_management.static_resource          # boolean
cf.bot_management.ja3_hash                 # string (Enterprise)
cf.bot_management.ja4                      # string (Enterprise)
cf.bot_management.detection_ids            # array
cf.bot_management.js_detection.passed      # boolean
cf.bot_management.corporate_proxy          # boolean (Enterprise)
cf.verified_bot_category                   # string

# Workers equivalent
request.cf.botManagement.score
request.cf.botManagement.verifiedBot
request.cf.botManagement.ja3Hash
request.cf.botManagement.ja4
request.cf.botManagement.jsDetection.passed
request.cf.verifiedBotCategory
```

## JA4 Signals (Enterprise)

```typescript
export default {
  async fetch(request: Request): Promise<Response> {
    const cf = request.cf as any;
    const ja4Signals = cf?.ja4Signals;
    
    if (!ja4Signals) return fetch(request); // Not available for HTTP or Worker routing
    
    // Check for anomalous behavior
    const heuristicRatio = ja4Signals.heuristic_ratio_1h ?? 0;
    const browserRatio = ja4Signals.browser_ratio_1h ?? 0;
    
    if (heuristicRatio > 0.5 || browserRatio < 0.3) {
      return new Response('Suspicious traffic', { status: 403 });
    }
    
    return fetch(request);
  }
};
```

## Common Patterns

### Mobile App Pattern
```typescript
const MOBILE_APP_JA4 = 'your_mobile_app_ja4_fingerprint';

export default {
  async fetch(request: Request): Promise<Response> {
    const cf = request.cf as any;
    const botMgmt = cf?.botManagement;
    
    if (botMgmt?.ja4 === MOBILE_APP_JA4) return fetch(request); // Allow mobile app
    if (botMgmt?.score && botMgmt.score < 30) return new Response('Bot detected', { status: 403 });
    
    return fetch(request);
  }
};
```

### Corporate Proxy Exemption
```typescript
export default {
  async fetch(request: Request): Promise<Response> {
    const cf = request.cf as any;
    const botMgmt = cf?.botManagement;
    
    if (botMgmt?.corporateProxy) return fetch(request); // Exempt corporate proxy traffic
    if (botMgmt?.score && botMgmt.score < 30 && !botMgmt.verifiedBot) {
      return new Response('Bot detected', { status: 403 });
    }
    
    return fetch(request);
  }
};
```

### Log Bot Data
```typescript
export default {
  async fetch(request: Request): Promise<Response> {
    const cf = request.cf as any;
    const botMgmt = cf?.botManagement;
    
    console.log({
      score: botMgmt?.score,
      verifiedBot: botMgmt?.verifiedBot,
      ja3Hash: botMgmt?.ja3Hash,
      ja4: botMgmt?.ja4,
      detectionIds: botMgmt?.detectionIds,
      jsDetection: botMgmt?.jsDetection?.passed,
      corporateProxy: botMgmt?.corporateProxy,
    });
    
    return fetch(request);
  }
};
```

## Bot Analytics

### Access Locations
- Dashboard: Security > Bots (old) or Security > Analytics > Bot analysis (new)
- GraphQL API for programmatic access
- Security Events & Security Analytics
- Logpush/Logpull

### Available Data
- **Enterprise BM**: Bot scores (1-99), bot score source, distribution
- **Pro/Business**: Bot groupings (automated, likely automated, likely human)
- Top attributes: IPs, paths, user agents, countries
- Detection sources: Heuristics, ML, AD, JSD
- Verified bot categories

### Time Ranges
- **Enterprise BM**: Up to 1 week at a time, 30 days history
- **Pro/Business**: Up to 72 hours at a time, 30 days history
- Real-time in most cases, adaptive sampling (1-10% depending on volume)

## Logpush Fields

```txt
BotScore              # 1-99 or 0 if not computed
BotScoreSrc           # Detection engine (ML, Heuristics, etc.)
BotTags               # Classification tags
BotDetectionIDs       # Heuristic detection IDs
```

Access via Logpush (stream to cloud storage/SIEM), Logpull (API to fetch logs), or GraphQL API (query analytics data).
