APIs-Google user agent

APIs-Google is the user agent used by Google APIs to deliver push notification messages.
Application developers can request these notifications to avoid the need for continually
polling Google’s servers to find out if the resources they are interested in have changed.
To make sure nobody abuses this service, Google requires developers to prove that they own
the domain before allowing them to register a URL with a domain as the location where they
want to receive messages.

How APIs-Google accesses your site

APIs-Google sends each push notification using an HTTPS POST request. If the request fails due
to an error condition that might be temporary, APIs-Google will resend the notification. If
the request still doesn’t succeed, it will continue to retry—based on an exponential backoff
schedule—up to a maximum of several days.

The rate at which APIs-Google accesses your site varies by how many push notification requests
were created for servers on your site, by how fast the monitored resources are getting
updated, and by the number of retries occurring. As a result, the APIs-Google traffic patterns
can be consistent in some scenarios, but in other scenarios the traffic can be sporadic or
spiky.

Prepare your site for APIs-Google

APIs-Google uses HTTPS to deliver push notifications, so it requires your site to have a valid
SSL certificate. Invalid certificates include the following:

• Self-signed certificates.
• Certificates signed by an untrusted source.
• Certificates that have been revoked.

Avoid unnecessary retry requests by ensuring that your application is well-designed and
responds promptly to notification messages (within seconds).

Prevent APIs-Google from calling your site

To prevent APIs-Google from calling your site, do one of the following:

• Unregister for notifications. If you administer a domain that has
  subdomains or URL subspaces that are owned or administered separately, one of the subdomain
  owners may have set up an application that uses push notifications. If you want to block
  APIs-Google, contact anyone who might have set up an application like this and ask them to
  disable it.
• Use robots.txt. The user agent to specify in the robots.txt file is
  APIs-Google – APIs-Google does not follow rules for the Googlebot user agent.
  There may be a small delay before APIs-Google discovers your robots.txt file change. If
  APIs-Google continues to send messages to your site several days after you’ve blocked it in
  robots.txt, check that the robots.txt is in the correct location.

Verify the caller

If you suspect that you are receiving spoofed requests, you can
verify that a bot accessing your server really is calling from google.com.
Search your logs for any IP addresses identifying themselves as the
APIs-Google user agent; a reverse DNS lookup shows the googlebot.com or
google.com domain.