{
  "name": "RelvatoBot",
  "version": "1.0",
  "type": "synthetic-monitoring-agent",
  "purpose": "Website monitoring: availability, functional checks (checkout, login), visual and structural change detection, performance, and security hygiene — on sites whose owner connected them to Relvato.",
  "operator": {
    "name": "Relvato",
    "url": "https://www.relvato.com",
    "contact": "mailto:contact@relvato.com"
  },
  "documentation": "https://www.relvato.com/bot",
  "verified_by": [
    {
      "name": "Cloudflare",
      "listing": "https://radar.cloudflare.com/bots/directory/relvatobot"
    }
  ],
  "access_model": "direct",
  "access_model_note": "Only Relvato can send requests presenting as RelvatoBot, and only to sites whose owner connected and verified them. Checks are configured by each site's own owner.",
  "user_agent": "RelvatoBot/1.0 (+https://www.relvato.com/bot)",
  "user_agent_pattern": "RelvatoBot\\/[0-9.]+",
  "web_bot_auth": {
    "directory": "https://www.relvato.com/.well-known/http-message-signatures-directory",
    "algorithm": "ed25519",
    "tag": "web-bot-auth",
    "signed": "every request, including subresources of a monitored page"
  },
  "ip_list": {
    "url": "https://www.relvato.com/bot-ips.json",
    "stability": "rotating",
    "note": "Addresses observed recently, not a fixed set. Use Web Bot Auth to verify a request really came from Relvato."
  },
  "site_authorization_header": {
    "name": "X-Relvato-Token",
    "note": "Per-site secret shown in the site's Relvato settings. It authorizes Relvato for that one site; it does not prove a request came from Relvato — the Web Bot Auth signature does."
  },
  "behavior": {
    "scope": "Only sites whose owner connected them to Relvato. Relvato does not crawl the web.",
    "robots_txt": "Read on every monitored site and matched against RelvatoBot. Crawl-delay is honoured now; Disallow enforcement is being rolled out — during the rollout a disallowed path is recorded rather than skipped, so no monitoring a customer configured stops without warning. A site owner can override the rule for their own site, since they set up the monitor.",
    "crawl_delay": "Honoured as a floor for request pacing.",
    "retry_after": "Honoured on 429 and 503 responses.",
    "rate_limiting": "Paced and jittered requests, one monitor at a time per domain, and an automatic back-off that holds the rest of a site's monitors once a firewall blocks one.",
    "challenges": "Never bypassed. Relvato does not solve CAPTCHAs or evade bot-protection; a blocked check is reported to the customer as blocked.",
    "crawler_user_agents": "One monitor (answer-engine readiness) asks a customer's own server whether it would serve GPTBot, Googlebot and similar, by sending those user agents to that customer's site only. It never accompanies a monitoring request."
  },
  "opt_out": {
    "documentation": "https://www.relvato.com/bot",
    "contact": "mailto:contact@relvato.com",
    "note": "Relvato only visits sites its customers connected, so there is nothing to opt out of unless your site is being monitored; blocking the bot at your firewall also works, and the run is then reported as blocked."
  }
}