Bot Detection API
Your open rates and click rates are lying to you. Security scanners pre-click every link, Apple MPP pre-loads every pixel, and botnets inflate clicks for ad fraud. The industry term for all of it is Non-Human Interactions (NHI), established by the M3AAWG Senders Committee, whose white paper Omnivery's founder helped write. The Omnivery Bot Detection API classifies NHI with unparalleled accuracy and returns a simple verdict per event: is_bot: true or is_bot: false. Used by beehiiv, which saved $14.4 million in fraudulent ad spend over six months.
Three separate sources of Non-Human Interactions (NHI) feed the same reporting your decisions come out of. Only one of the three is abusive, which is why they cannot all be handled the same way.
Security software follows links before the recipient ever sees the email - enterprise gateways such as Proofpoint, Mimecast, Barracuda and Microsoft Defender, and the large consumer mailbox providers too. Those clicks can enter your reporting as engagement even though no human clicked.
iOS 15+ routes opens through the Apple proxy, pre-loading all pixels regardless of whether the recipient reads. A 50% open rate may be much lower in reality.
Newsletter ad networks are targeted by botnets: diverse IPs, legitimate user agents, realistic intervals. Invisible to simple rules.
Bot implies abuse. Most of this traffic is not abusive. It is security software following the links in a message to check them for malware and phishing, before the recipient ever opens it. Dozens of vendors do this, not a handful. Enterprise gateways such as Mimecast, Proofpoint, Barracuda and Microsoft Defender for Office 365 are simply the most recognizable names; Microsoft scans links well beyond Defender, and Gmail, Yahoo and effectively every large mailbox provider scan consumer mail the same way. It is not an enterprise-only phenomenon. That scanning is a large part of why email is survivable at all, and it is working exactly as designed.
It is also why generic web bot detection misclassifies email engagement. A web bot detection service is built to identify an adversary probing a website, so it reasons about intent and acts on it: block, challenge or allow. Applied to email, that framing is wrong from the start, because the largest single source of automated interaction is legitimate security infrastructure doing its job. Why web bot detection fails for email covers the mechanics.
The distinction is operational rather than cosmetic. You cannot block non-human interactions, and you would not want to: they arrive from the security layer sitting in front of your recipient, whether that is a gateway their employer pays for or the scanning their mailbox provider does by default, so refusing them means refusing delivery. What you can do is classify them accurately, so engagement metrics, list hygiene and automation triggers rest on interactions a person actually had. An open rate that counts Apple MPP as readership, and a re-engagement campaign that reads a scanner click as interest, are the same failure showing up in two places.
The term itself came out of the M3AAWG Senders Committee. Omnivery's founder was part of the group that produced the Non-Human Interactions white paper, and argued for the term "Non-Human Interactions" over "bots" on the grounds that most such traffic originates from legitimate security vendors rather than from abuse. That argument prevailed, and NHI is now the term in industry-wide use. The document is Exploring the Impact of Nonhuman Interactions on Email Send Metrics (M3AAWG-136, November 2020). For the full definition, what causes NHI and how prevalent it now is, see Non-Human Interactions (NHI) in email.
First-party findings from The State of Email Bots 2026, each drawn from a separate Omnivery dataset covering our own sending and the traffic screened by this API. Automated opens have been a known problem since Apple MPP. The data now shows significant contamination of clicks as well. Also available as a 10-page PDF.
The API returns a per-event verdict using 20+ proprietary datasets developed over 8+ years.
Building NHI detection in-house requires significant ongoing investment in data science, engineering, and infrastructure, and the non-human interaction landscape moves continuously. The Omnivery Bot Detection API provides that capability from day one.
| Criteria | Build in-house | Integrate Omnivery Bot Detection API |
|---|---|---|
| Time to first detection | 6-18 months | Days |
| Detection accuracy at launch | Low (obvious signals only) | High (8+ years of data) |
| Bot infrastructure coverage | Limited and degrading | Continuously updated |
| Engineering cost | Ongoing | Integration only |
| Data science requirement | Yes - ongoing | No |
| PII handling overhead | Yes | No - hashed identifiers |
| Compliance exposure | Higher | Lower (EU infrastructure, GDPR-native) |
| Revenue model | Custom | Volume-based, margin-friendly |
Contact sales@omnivery.com to discuss ESP partnership arrangements, white-label options, and volume pricing.
Revenue depends on engagement metrics. beehiiv saved $14.4 million in fraudulent ad spend over six months.
Remove non-human activity from the engagement data you report to customers. Included automatically for Omnivery tracking customers. Third-party ESPs supported subject to vetting.
2FA and order confirmations pass through enterprise gateways. Contaminated data degrades ML models over time.
Botnets target click-based payouts with diverse IPs, realistic UAs, and plausible timing.
You send raw tracking events and receive one NHI verdict per event. There is nothing to install in the sending path, and no change to how your mail is delivered.
Send events in batches or one at a time; results come back per event.
Each event needs three things from your raw tracking data: the source IP, the user agent string and a unique event ID. Extra context such as the action, domain and message makes the verdict more reliable.
{
"events": [
{
"ip": "156.17.201.170",
"uas": "Mozilla/5.0 (iPhone; CPU iPhone OS 16_5 ...)",
"event_id": "unique-event-identifier-123",
"action": "click",
"domain": "example.com",
"recipient_id": "hashed-recipient-id",
"message_id": "message-identifier",
"ts": 1721474736
}
]
}Your batch comes back as sent, with one verdict added to each event: is_bot: true or is_bot: false. Clean, unambiguous, actionable.
{
"events": [
{
"ip": "156.17.201.170",
"uas": "Mozilla/5.0 (iPhone; CPU iPhone OS 16_5 ...)",
"event_id": "unique-event-identifier-123",
"action": "click",
"domain": "example.com",
"recipient_id": "hashed-recipient-id",
"message_id": "message-identifier",
"ts": 1721474736,
"is_bot": false
}
]
}Access is enabled per domain after a short technical review. Platforms that cannot surface raw event data (source IP and user agent per interaction) cannot integrate, and third-party platform integrations are reviewed before access is enabled. Contact sales@omnivery.com.
Because a large share of those opens were never read by a person. Since Apple Mail Privacy Protection launched with iOS 15, Apple pre-loads the tracking pixel in every message it delivers, whether or not the recipient opens it, and corporate security gateways do the same thing when they scan a message. Around 50% of the B2C opens Omnivery measures are non-human. The industry term for this is Non-Human Interactions, or NHI, and an open rate is the sum of real readers and NHI with no way to tell them apart until each event is classified.
Bot clicks are link clicks recorded in your reporting that no person made. Most come from security software following every link in a message to check it for malware or phishing before the recipient ever sees it. Dozens of vendors do this rather than a handful: enterprise gateways such as Mimecast, Proofpoint, Barracuda and Microsoft Defender are the most recognizable, and Gmail, Yahoo and effectively every large consumer mailbox provider scan links too, so it is not an enterprise-only problem. A smaller share is deliberate fraud, such as botnets clicking newsletter ads to inflate advertiser billing. The industry term covering both is Non-Human Interactions (NHI). Omnivery measures B2C bot clicks at about 16% in 2026, up from about 2% in 2023.
You do not, and you should not try. The largest source is security infrastructure that your recipients' own employers pay for, so blocking it means your mail stops being delivered. The workable approach is classification rather than prevention: identify which interactions were non-human, then keep them out of the metrics, list hygiene decisions and automation triggers that would otherwise act on them. That is what the Bot Detection API does. It applies no blocking, no CAPTCHAs and no suppression.
Some of them. In B2C sending, roughly half the opens Omnivery measures are non-human, and have been since Apple Mail Privacy Protection launched. In B2B the share varies much more widely, because it depends on the security stack sitting in front of each recipient. An open rate on its own cannot tell you which is which. Classifying Non-Human Interactions (NHI) per event is what separates the two, and clicks need the same treatment as opens, for different reasons.
A Non-Human Interaction is an email open or click generated by software rather than by the recipient. The main sources are corporate security gateways scanning links for malware and phishing, Apple Mail Privacy Protection pre-loading tracking pixels, inbox tracking and deliverability testing tools, and malicious botnets. NHI is the term established by the M3AAWG Senders Committee and now in industry-wide use. Marketers usually describe the same thing as bot opens and bot clicks.
Web bot traffic means an adversary probing a website, and web bot detection exists to block or challenge it. NHI differs in origin and in what you should do about it: most of it comes from legitimate security vendors performing a service the recipient's employer paid for, so it cannot be blocked, and the correct response is accurate classification. This is also why generic web bot detection misclassifies email engagement. It is built to reason about intent and act on it, and applied to email that framing is wrong from the start.
Because bot implies abuse, and most of this traffic is not abusive. It is security software checking links. The term was settled in the M3AAWG Senders Committee, and Omnivery's founder was part of the group that produced the Non-Human Interactions white paper and argued for Non-Human Interactions over bots on the grounds that most such traffic originates from legitimate security vendors rather than from abuse. The document is Exploring the Impact of Nonhuman Interactions on Email Send Metrics, M3AAWG-136, published November 2020.
Yes. Apple MPP pre-loads tracking pixels whether or not the recipient reads the message, so the resulting open was generated by software rather than by a person. It is the single largest source of non-human opens in B2C sending, accounting for more than 95% of the non-human opens Omnivery identifies there. MPP affects opens only. Non-human clicks come from security scanners, tracking tools and botnets instead.
A boolean is_bot field per event - true if non-human, false if likely human. Response also returns all originally submitted fields so you can match by event_id.
Yes, provided raw tracking events are available with source IP and user agent per interaction. If your ESP aggregates, proxies, or omits these fields, integration is not technically possible.
Yes. Apple MPP opens are identified and flagged.
Contact sales@omnivery.com. Access is enabled per domain after a short technical review of your tracking data.
Designed with privacy in mind. recipient_id is recommended hashed. IPs and UAs not permanently stored associated with identifiable individuals. EU headquarters, GDPR-native architecture. DPA available at omnivery.com/legal/dpa.
New measurements of automated opens and clicks, what the classifiers are seeing change, and notes on the API as it develops. Subscribe and it arrives when there is something worth reporting.
Intelligence is only as good as the data beneath it. As automation and AI make more decisions from engagement signals, separating real engagement from Non-Human Interactions is what keeps those decisions trustworthy. Contact the team to discuss access and confirm your tracking data includes what the API needs.
If you would rather start from the data than the product, The State of Email Bots 2026 carries the year-by-year series and the complete breakdown by mailbox provider. It is also available as a 10-page PDF.
For one concrete symptom, see why bots click unsubscribe and confirm links.
Ready for communications infrastructure you can rely on when it matters most?