{"uid":"cap_VoM0Y4sEsbfzqOmzGw5C0","slug":"netzhandwerker-traffic-classifier-15b1a9ec","name":"Netzhandwerker Traffic Classifier","description":"Groups the access records you pass into clients and sorts each in two stages: person or machine, then, for a machine, the purpose. Signals: cadence and its scatter, path shape and consecutive numeric runs, asset share, referer, method mix, not-found share, robots.txt, user agent product token. Each signal returns what was observed, its weight and why. A lead under two points stays unknown. Nothing is stored, no raw IP is returned: IPv4 cut to /24, IPv6 to /48.","url":"https://tools.halowerk.com/v1/traffic/classify?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"group_by":{"enum":["ip","user_agent","ip_user_agent","none"],"type":"string","default":"ip_user_agent","description":"How records are grouped into clients."},"requests":{"type":"array","items":{"type":"object","anyOf":[{"required":["time_unix_s"]},{"required":["time"]}],"examples":[{"ip":"203.0.113.44","path":"/products/100","method":"GET","status":200,"user_agent":"python-requests/2.32.3","time_unix_s":1786000000}],"required":["path"],"properties":{"ip":{"type":"string","description":"Client IPv4 or IPv6 address; output is masked."},"path":{"type":"string","minLength":1,"description":"Requested path, including a query string if relevant."},"time":{"type":"string","description":"Request time as an ISO 8601 timestamp."},"bytes":{"type":"integer","minimum":0,"description":"Response body size in bytes."},"method":{"type":"string","description":"HTTP method such as GET or POST."},"status":{"type":"integer","maximum":599,"minimum":100,"description":"HTTP response status."},"referer":{"type":"string","description":"Referer header value."},"user_agent":{"type":"string","description":"User-Agent header value."},"time_unix_s":{"type":"number","description":"Request time as Unix seconds."}},"additionalProperties":false},"maxItems":2000,"minItems":1,"description":"Access records. Each needs path and either time_unix_s or time. The service caps the whole request body at 256 KB, so long records reach that limit before maxItems."},"max_clients":{"type":"integer","default":100,"maximum":500,"minimum":1,"description":"How many clients are reported, largest first."},"session_gap_s":{"type":"integer","default":1800,"maximum":86400,"minimum":60,"description":"Silence after which the next request starts a new session."},"min_requests_per_client":{"type":"integer","default":2,"maximum":1000,"minimum":1,"description":"Clients below this many requests are skipped and counted in clients_skipped."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.004","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.004/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_mfb3F5RM5xHX1_6ivNQ3q","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.004","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Classifies web access log records into human vs. bot clients with multi-signal scoring, grouping records by IP/user-agent and explaining each classification signal.","exampleAgentPrompt":"I have 500 access log records from the past hour — can you classify them as human or bot traffic, grouping by IP and user agent, and tell me what signals tipped the classification for each client?","exampleUseCases":[{"title":"Bot detection for e-commerce site","prompt":"Here are the last 2000 access log entries from our online store — please group them by IP and user agent, classify each client as human or bot, and explain the signals that led to each decision. Flag anything that looks like a scraper or crawler."},{"title":"Security audit of API gateway logs","prompt":"I've got server logs from our API gateway for the past 6 hours. Can you analyze them to find which clients are automated versus real users, using a session gap of 30 minutes and only reporting clients with at least 5 requests?"},{"title":"Content publisher blocking suspicious crawlers","prompt":"We're seeing unusual traffic on our news site. Here are the access records — group them by IP only, classify each as human or machine, and tell me which ones appear to be unauthorized scrapers based on path patterns and request cadence."}],"resultDescription":"Returns grouped client records with a two-stage classification (person or machine, then machine purpose), a numeric lead score, and per-signal breakdowns showing the observed value, weight, and rationale. Clients with a lead under two points remain 'unknown'. IPv4 addresses are truncated to /24, IPv6 to /48. No raw IPs or raw data are stored.","failureModes":["Request body exceeds 256 KB limit — reduce record count or field verbosity","Records missing required 'path' or timestamp fields are rejected","Unrecognized field names in records cause rejection rather than silent ignore","Fewer than min_requests_per_client requests causes client to be skipped and counted in clients_skipped","max_clients or session_gap_s outside allowed ranges returns validation error","Malformed ISO 8601 timestamps or negative Unix timestamps cause parse errors"],"whenToPreferThis":"Choose this endpoint when you have raw web access logs and need explainable, signal-based bot/human classification without storing any PII. It is especially useful when you want per-signal reasoning (not just a binary label), need privacy-preserving IP anonymization, or want to handle batches up to 2000 records in a single call. Prefer it over generic IP reputation lookups when cadence patterns, path shape, and method mix matter for your classification logic.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T12:39:11.729Z","isFirstParty":false,"canonicalSlug":"netzhandwerker-traffic-classifier-15b1a9ec"}