What does AASA-Bot request?

Cloudflare describes a request to a specific path for a hostname that returns app-association metadata. Apple's documentation places that document at `/.well-known/apple-app-site-association` or `/apple-app-site-association`, served over HTTPS without a redirect.

Is AASA-Bot an AI crawler?

No documented evidence gives it an AI search or training function. Its stated purpose is fetching the association metadata used by Apple platform features such as Universal Links, not indexing ordinary page content for search or model training.

Does AASA-Bot respect robots.txt?

Cloudflare's bot directory marks it as not following robots.txt. A robots.txt snippet is therefore not a dependable way to control it. Use a server or edge firewall rule if you need enforced access control.

Can blocking AASA-Bot break Universal Links?

Yes. If Apple's content delivery network cannot retrieve the current association file, it may be unable to verify the link between your domain and app. Links that should open the app can open the website instead. Only block the fetch after confirming that no app depends on the association.

How can I identify AASA-Bot in access logs?

Cloudflare's bot directory lists the user-agent pattern `AASA-Bot/` and the observed value `AASA-Bot/1.0.0`. Check that the request also targets the association-file path. The supplied record provides neither IP verification nor a signature-agent URL, so the user-agent string alone is not conclusive proof of origin.

Apple App Site Association Bot Guide

What is Apple App Site Association?

Apple App Site Association, usually shortened to AASA, is part of the trust setup behind Universal Links. A website publishes an apple-app-site-association JSON document, and an iOS app declares the same domain in its Associated Domains entitlement. When those records match, a supported HTTPS link can open in the installed app. If the app is not installed, the same link opens as a normal web URL.

AASA-Bot/1.0.0 is the user agent Cloudflare's bot directory records for Apple's fetcher. Its request pattern is narrow: it asks a hostname for the association document that maps URL patterns to native apps. It is not described as crawling ordinary pages or collecting link-preview metadata.

Apple documents the file at /.well-known/apple-app-site-association or the site root as /apple-app-site-association. It must be available over HTTPS without a redirect. The filename has no .json extension, even though the response body is JSON. Those details matter because the response is configuration data rather than ordinary site content.

Starting with iOS 14 and macOS 11, apps obtain association files through an Apple-managed content delivery network. If the network does not have a current copy, it connects to the site to retrieve one. An AASA-Bot entry in a server log therefore reflects a configuration fetch from Apple infrastructure, not necessarily a person tapping or viewing a page.

A valid document tells the system which app identifiers and URL paths the site authorizes. If the fetch is denied or the response is invalid, Apple cannot confirm that trust relationship from the current file. Universal Links may then open the website instead of the app. Blocking this endpoint can affect app routing even while the rest of the site remains accessible.

AASA-Bot has no documented role in AI search or model training. Neither Apple's Universal Links documentation nor Cloudflare's bot record connects this fetcher with AI discovery. Do not count its requests as AI crawler visits, and do not expect allowing it to improve AI search visibility.

Indirectly relevant

Is Apple App Site Association relevant for AI search?

Indirectly. Apple App Site Association has no AI product of its own, but its output can end up in the systems that AI answers draw on.

Apple App Site Association fetches pages to build link-preview cards. It does not feed an AI index, but it reads the same Open Graph and structured metadata that AI systems parse to understand your pages, so clean preview metadata doubles as AI-friendly metadata.

How to handle Apple App Site Association

Allow AASA-Bot to reach the association file if an iOS app relies on Universal Links for your domain. Serve the extensionless JSON file over HTTPS and return it directly rather than through a redirect. Make sure bot challenges and other access controls do not intercept this request. A path-specific exception can expose the association file without granting automated access to the rest of the site.

A robots.txt block is not an appropriate control for this bot. Cloudflare's bot directory marks AASA-Bot as not following robots.txt, so a User-agent: AASA-Bot rule should not be presented as reliable enforcement. If you intentionally want to deny the fetch, enforce the decision at your server or edge firewall. Confirm first that no production app depends on the file, because denying it can break Universal Links.

In access logs, compare the user agent with the requested path and response status. Cloudflare's bot directory lists the pattern AASA-Bot/ and the observed user agent AASA-Bot/1.0.0, but the supplied record has no verified IP range or signature-agent URL. The expected association-file request supports the identification; the user-agent string by itself does not prove that a request came from Apple.

Examples

A mobile team adds `applinks:shop.example.com` to its app and publishes the matching association file. Its firewall permits AASA-Bot at `/.well-known/apple-app-site-association`, and the team checks for a direct successful response before testing product links on iOS.
A security analyst sees `AASA-Bot/1.0.0` request only the association-file path. The request is classified as Universal Links infrastructure rather than an AI or content-crawling visit.

Frequently asked questions about Apple App Site Association

Learn about AI visibility monitoring and how Promptwatch helps your brand succeed in AI search.

Apple platforms use the file together with an app's Associated Domains entitlement to verify that the domain permits that app to handle particular URLs. For Universal Links, its JSON data associates app identifiers with supported URL paths.