JAFAR: A JSON-Based Format for Publishing IP Ranges of Automated HTTP Clients JAFAR
JAFAR: A JSON-Based Format for Publishing IP Ranges of Automated HTTP Clients is an agentic-web standard (document format) at step 2, Identify, governed by Individual Internet-Draft, not adopted by a working group; its own status is "Active Internet-Draft, Intended Status: Informational; expires 23 October 2026" (draft). It answers: How can a crawler or bot operator publish the IP ranges its automated clients use, in one machine-readable format that sites can check traffic against? Adoption is unmeasured, last verified 2026-10-20.
Identify JAFAR defines one JSON format in which operators of crawlers, AI bots and other automated HTTP clients publish the IP address ranges they send traffic from, so site operators can recognise legitimate automated traffic without maintaining a different parser per vendor [2]. A file is a single JSON object with a creation timestamp and one array of prefixes covering both IPv4 and IPv6. Each prefix can be tagged with the publisher's own service names, and an optional sync token signals changes [2]. The draft registers application/jafar+json, with a version parameter for future changes, and gives caching rules for consumers [2].
Overview
It says it codifies and extends common existing practice and complements forward-confirmed reverse DNS rather than replacing it [2]. It defines only the file, not where it lives or how sites should use it, so there is nothing to probe at an origin [2]. It sits beside Web Bot Auth, which identifies a client by signature rather than by address, and the expired crawler best-practices draft by the same author listed publishing IP ranges in a standard format as one of its six practices.
Current state: an individual draft, -00 of 2026-04-21, replacing the earlier draft-illyes-aipref-jafar. Discussion is on the aipref list despite the name [1][2]. It expires on 2026-10-23; if no -01 appears, this record should be marked expired as ardp was.
Discovery and probe
None defined: the draft specifies only the JSON file's syntax and semantics (media type application/jafar+json), not where it is published or how it is retrieved
NONE parse: on absent: The draft defines no fixed location for the file, so absence at any given URL says nothing about whether an operator publishes one.
History
- 2026-10-20 — added from gap scout 2026-10-20; verified against the datatracker page (via Exa) and the -00 text (IETF rsync mirror); expires 2026-10-23, watch for -01
Instances
No instances recorded yet.
See also
References
- Datatracker lists draft-illyes-webbotauth-jafar-00 as an active individual Internet-Draft by Gary Illyes, Informational, dated 2026-04-21 and expiring 2026-10-23; it replaces draft-illyes-aipref-jafar. — https://datatracker.ietf.org/doc/draft-illyes-webbotauth-jafar/ (2026-04-21) VERIFIED
- The -00 text defines a single JSON object with a required creationTime and prefixes array (one unified IPv4/IPv6 list of Prefix Objects, each with exactly one of ipv4Prefix or ipv6Prefix and optional services), an optional synctoken and notes, fetching, caching and versioning rules via the application/jafar+json media type, and says it codifies and extends common existing practice to complement, not replace, forward-confirmed reverse DNS. Discussion is on the aipref list (ai-control@ietf.org). — https://www.ietf.org/archive/id/draft-illyes-webbotauth-jafar-00.html (2026-04-21) VERIFIED