{
 "id": "jafar",
 "name": "JAFAR: A JSON-Based Format for Publishing IP Ranges of Automated HTTP Clients",
 "acronym": "JAFAR",
 "aliases": [
  "draft-illyes-webbotauth-jafar",
  "draft-illyes-aipref-jafar"
 ],
 "collisions": [],
 "step": "identify",
 "parties": [
  "agent-site"
 ],
 "form": "document-format",
 "track": "ietf",
 "scope": "general",
 "question": "How can a crawler or bot operator publish the IP ranges its automated clients use, in one machine-readable format that sites can check traffic against?",
 "analog": "A crawler's published list of IP ranges, checked alongside reverse DNS",
 "origin": {
  "org": "Gary Illyes (individual submission)",
  "date": "2025-09-30"
 },
 "governance": "Individual Internet-Draft, not adopted by a working group; despite 'webbotauth' in its name, discussion takes place on the AI Preferences (aipref) WG list ai-control@ietf.org; source at github.com/garyillyes/jafar",
 "native_status": "Active Internet-Draft, Intended Status: Informational; expires 23 October 2026",
 "phase": "draft",
 "implementation": "unknown",
 "adoption": {
  "level": "unmeasured",
  "by": null,
  "probe_run": null
 },
 "version": {
  "label": "draft-illyes-webbotauth-jafar-00",
  "date": "2026-04-21"
 },
 "spec_url": "https://datatracker.ietf.org/doc/draft-illyes-webbotauth-jafar/",
 "discovery": {
  "mechanism": "None defined: the draft specifies only the JSON file's syntax and semantics (media type application/jafar+json), not where it is published or how it is retrieved",
  "path": null
 },
 "probe": {
  "method": "NONE",
  "path": "",
  "parse": "",
  "on_absent": "The draft defines no fixed location for the file, so absence at any given URL says nothing about whether an operator publishes one."
 },
 "evidence": [
  {
   "claim": "Datatracker lists draft-illyes-webbotauth-jafar-00 as an active individual Internet-Draft by Gary Illyes, Informational, dated 2026-04-21 and expiring 2026-10-23; it replaces draft-illyes-aipref-jafar.",
   "date": "2026-04-21",
   "label": "VERIFIED",
   "url": "https://datatracker.ietf.org/doc/draft-illyes-webbotauth-jafar/"
  },
  {
   "claim": "The -00 text defines a single JSON object with a required creationTime and prefixes array (one unified IPv4/IPv6 list of Prefix Objects, each with exactly one of ipv4Prefix or ipv6Prefix and optional services), an optional synctoken and notes, fetching, caching and versioning rules via the application/jafar+json media type, and says it codifies and extends common existing practice to complement, not replace, forward-confirmed reverse DNS. Discussion is on the aipref list (ai-control@ietf.org).",
   "date": "2026-04-21",
   "label": "VERIFIED",
   "url": "https://www.ietf.org/archive/id/draft-illyes-webbotauth-jafar-00.html"
  }
 ],
 "summary_md": "JAFAR defines one JSON format in which operators of crawlers, AI bots and other automated HTTP clients publish the IP address ranges they send traffic from, so site operators can recognise legitimate automated traffic without maintaining a different parser per vendor [2]. A file is a single JSON object with a creation timestamp and one array of prefixes covering both IPv4 and IPv6. Each prefix can be tagged with the publisher's own service names, and an optional sync token signals changes [2]. The draft registers `application/jafar+json`, with a version parameter for future changes, and gives caching rules for consumers [2].\n\nIt says it codifies and extends common existing practice and complements forward-confirmed reverse DNS rather than replacing it [2]. It defines only the file, not where it lives or how sites should use it, so there is nothing to probe at an origin [2]. It sits beside Web Bot Auth, which identifies a client by signature rather than by address, and the expired crawler best-practices draft by the same author listed publishing IP ranges in a standard format as one of its six practices.\n\nCurrent state: an individual draft, -00 of 2026-04-21, replacing the earlier draft-illyes-aipref-jafar. Discussion is on the aipref list despite the name [1][2]. It expires on 2026-10-23; if no -01 appears, this record should be marked expired as `ardp` was.",
 "part_of": null,
 "group": null,
 "use_cases": [
  "attribute-agent-traffic",
  "control-ai-crawling"
 ],
 "audience": [
  "site-owner",
  "platform"
 ],
 "pairs_with": [
  "webbotauth",
  "ai-crawler-tokens-robots",
  "anonymous-bot-auth"
 ],
 "prerequisites": [],
 "dispute": null,
 "last_verified": "2026-10-20",
 "history": [
  {
   "date": "2026-10-20",
   "note": "added from gap scout 2026-10-20; verified against the datatracker page (via Exa) and the -00 text (IETF rsync mirror); expires 2026-10-23, watch for -01"
  }
 ],
 "watch": [
  {
   "type": "ietf",
   "doc": "draft-illyes-webbotauth-jafar"
  }
 ],
 "freshness": "current"
}