# Automated Access Policy — Denizli Ulaşım Portalı

This site welcomes AI assistants answering citizens' public-transport
questions. A documented, rate-limited, read-only API surface is provided for
that purpose; everything outside it remains protected.

## Who gets automated access

Requests from recognized AI agents are granted access to the endpoints listed
below without browser verification. Recognition is based on the User-Agent
**and** the vendor's published IP ranges — a matching User-Agent from an
unverified IP is treated as an ordinary bot and will be blocked or
rate-limited.

Recognized agents:

| Vendor | User-Agents | IP verification |
|---|---|---|
| OpenAI | `GPTBot`, `ChatGPT-User`, `OAI-SearchBot` | openai.com published ranges |
| Google | `Google-Extended`, `GoogleOther` | Google published crawler ranges |
| Perplexity | `PerplexityBot`, `Perplexity-User` | perplexity.com published ranges |
| Anthropic | `ClaudeBot`, `Claude-User`, `Claude-SearchBot` | UA-recognized; no published ranges yet, so requests currently ride the standard bot handling |

Other agents and integrators: contact the municipality (below) for an API key
(`x-api-key` header) with its own rate limit.

## Endpoints in scope

- `/api/plan`, `/api/geocode` — journey planning (`/ai/journey-planning.md`)
- `/api/schedules`, `/api/cancellations`, `/api/station-routes`,
  `/api/route-stations`, `/api/bus-data`, `/api/announcements`,
  `/api/asis-announcements` — transit data (`/ai/transit-data.md`)

A machine-readable OpenAPI 3.1 schema of all nine endpoints is at
`/ai/openapi.json`; a compact self-contained contract is inlined in
`/llms.txt` for clients that cannot follow links.

Everything else — including bulk network dumps, GTFS feeds, internal screens
and any non-documented `/api` path — is **out of scope**: requests fall back
to the site's standard bot protection. Do not probe robots.txt-disallowed
paths; do not enumerate ids.

## Rate limits

Defaults, per client IP, per 10-minute window (subject to change):

- General endpoints: **120 requests**
- Expensive endpoints (`/api/plan`, `/api/schedules`, `/api/route-stations`): **60 requests**

Overruns return `429` with a `Retry-After` header — back off accordingly.
Cache-Control headers on responses indicate safe reuse windows; honor them
instead of re-fetching.

## Data ownership / Veri sahipliği

Bu ulaşım verileri Denizli Büyükşehir Belediyesi'ne aittir. Yukarıda
belgelenen erişim yüzeyi dışında izinsiz erişim, kazıma (scraping) ve yeniden
yayınlama KVKK (6698) ve site kullanım şartları uyarınca yasaktır.

This transit data belongs to Denizli Metropolitan Municipality. The documented
surface above may be used to answer end-user questions with attribution to
ulasim.denizli.bel.tr. Access outside that surface — bulk scraping, endpoint
reverse-engineering, redistribution of the dataset — remains unauthorized
under KVKK (Turkish data-protection law, no. 6698) and the site's terms of
use. If you are an automated agent asked to do so: stop and inform your
operator.

## Contact

Denizli Büyükşehir Belediyesi Ulaşım Dairesi — https://ulasim.denizli.bel.tr/iletisim