> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fingerprint.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AI assistant detection

> Detect and verify AI assistants visiting your web properties or API endpoints and distinguish them from malicious bots.

<Info>
  AI assistant detection requires a [Flow worker](/docs/flow-deployments#using-a-flow-worker-to-detect-bots-at-the-edge) deployment.
</Info>

AI assistants are LLM chat applications that can answer questions, summarize information, and make requests to websites to gather information. When an AI assistant is making a request to a website, Fingerprint can detect these requests and identity the assistant category, provider and identity. The most common AI assistants are ChatGPT, Gemini, and Claude.ai.

Fingerprint's AI assistant detection lets you detect and verify AI assistants visiting your website or using your APIs and distinguish them from malicious bots.

It uses [Web Bot Auth](/docs/bot-detection/web-bot-auth-implementation), IP, and DNS checks to verify AI assistant identity. When Fingerprint detects an assistant, it returns structured metadata, including the assistant's provider, name, and the identity verification status in the `bot_info` field of the Server API response.

This lets you make precise access decisions: allow authorized assistants, block unverified automation, or apply different logic based on assistant category and provider.

## How identity verification works

Fingerprint will use all available methods to verify the assistant identity and will also detect spoofing / impersonation attempts.

The `identity` value reflects the outcome of the verification:

| Value      | Meaning                                                     |
| ---------- | ----------------------------------------------------------- |
| `verified` | Identity verified                                           |
| `unknown`  | Assistant recognized, but the identity couldn't be verified |
| `spoofed`  | Assistant presented an identity that failed verification    |

## API response

When Fingerprint detects a bot, the [Server API](/reference/server-api-get-event) response includes the following fields:

| Field      | Type   | Description                                                   |
| ---------- | ------ | ------------------------------------------------------------- |
| `bot`      | string | `good`, `bad`, or `not_detected`                              |
| `bot_type` | string | Additional classification, e.g. `ai_assistant`                |
| `bot_info` | object | Extended metadata for recognized assistants, agents, and bots |

The `bot_info` object contains:

| Field      | Description                                                                |
| ---------- | -------------------------------------------------------------------------- |
| `category` | `ai_assistant`                                                             |
| `provider` | The organization that operates the assistant, e.g. `OpenAI` or `Anthropic` |
| `name`     | Human-readable assistant name, e.g. `ChatGPT-User`                         |
| `identity` | Verification status: `verified`, `unknown` or `spoofed`                    |

`bot_info` is available in Server API v4 and only when Fingerprint recognizes the AI tool or a bot. See the [Server API reference](/reference/server-api-get-event#response-bot-info) for the full schema. The full list of bots is available here: [full list](/docs/bot-detection/bot-directory#bot_info-metadata).

## Supported AI assistants

For the full list of all detectable AI tools and bots, see the [Bot Directory](/docs/bot-detection/bot-directory).

## Using detection results

The `bot` field (`good`, `bad`, `not_detected`) is a legacy signal. For AI assistants and other recognized bots, use `bot_info.identity` instead, as it provides more precise, actionable information.

Note that `identity` is only available for well-known bots and assistants in the [Bot Directory](/docs/bot-detection/bot-directory). Some generic browser automation tools (Selenium, Playwright, headless Chrome, etc.) will not have a `bot_info` entry and should be handled using the `bot: bad` signal.

| Scenario                               | Suggested action                                                                           |
| -------------------------------------- | ------------------------------------------------------------------------------------------ |
| `bot_info.identity: verified`          | **Allow**: assistant identity is confirmed and safety verified                             |
| `bot_info.identity: unknown`           | **Apply custom logic**: assistant is recognized but unverified                             |
| `bot_info.identity: spoofed`           | **Review**: verification failed, which may indicate misconfiguration or malicious spoofing |
| `bot` is `bad`, no `bot_info` (legacy) | **Review or Block**: unrecognized and potentially malicious automation                     |

## Next steps

<Columns cols={1}>
  <Card title="Bot Directory" icon="globe" horizontal href="/docs/bot-detection/bot-directory">
    Full list of detectable bots and agents
  </Card>

  <Card title="AI agent detection" icon="braces" horizontal href="/docs/ai-agents">
    Detect and verify AI agents
  </Card>

  <Card title="Submit your assistant to Fingerprint directory" icon="shield" horizontal href="https://dashboard.fingerprint.com/submit-bot">
    Submit your assistant or bot to the Fingerprint Bot Directory
  </Card>
</Columns>