# WorkBOS, https://www.workbos.com
# A product of Shahzad & Rainer LLC.
#
# Policy: the marketing, comparison and legal/trust surfaces are open to every crawler,
# including AI answer engines (we WANT to be quoted). Authenticated app routes, API
# endpoints and token-scoped share links are closed. They hold tenant data and would
# waste crawl budget on pages that only ever return a login screen.
#
# ⚠️  A crawler obeys EXACTLY ONE group: the most specific User-agent match, and it ignores
# the '*' group entirely. So every Disallow list below is repeated verbatim inside each
# named group. Removing one turns that crawler loose on the tenant share links.
# ⚠️  Disallow is a PREFIX match, not a path segment: '/reseller' would also block the
# public '/resellers' marketing page, hence the explicit '$' and '/' forms.
# Duplicate routes (/landing, /landing2) are deliberately NOT disallowed. Both 301 to '/'
# as of 2026-08-24, and a blocked page can never be read, so a crawler that cannot fetch them
# can never follow the redirect either.

User-agent: *
Allow: /

# Authenticated app + machine endpoints (never useful to a crawler)
Disallow: /api/
Disallow: /dashboard
Disallow: /settings
Disallow: /platform
Disallow: /reseller$
Disallow: /reseller/
Disallow: /login
Disallow: /signup
Disallow: /verify-email
Disallow: /update-password
Disallow: /approve-owner
Disallow: /confirm-deletion
Disallow: /oauth/

# Token-scoped tenant share links (hosted invoices, forms, quotes, bookings, e-signature,
# meetings, shared drive links, report views). Public by design, private in substance.
Disallow: /i/
Disallow: /r/
Disallow: /f/
Disallow: /q/
Disallow: /book/
Disallow: /sign/
Disallow: /meet/
Disallow: /drives/l/
Disallow: /reports/

# AI answer engine: same access as any other crawler, stated explicitly.
User-agent: GPTBot
Allow: /

# Authenticated app + machine endpoints (never useful to a crawler)
Disallow: /api/
Disallow: /dashboard
Disallow: /settings
Disallow: /platform
Disallow: /reseller$
Disallow: /reseller/
Disallow: /login
Disallow: /signup
Disallow: /verify-email
Disallow: /update-password
Disallow: /approve-owner
Disallow: /confirm-deletion
Disallow: /oauth/

# Token-scoped tenant share links (hosted invoices, forms, quotes, bookings, e-signature,
# meetings, shared drive links, report views). Public by design, private in substance.
Disallow: /i/
Disallow: /r/
Disallow: /f/
Disallow: /q/
Disallow: /book/
Disallow: /sign/
Disallow: /meet/
Disallow: /drives/l/
Disallow: /reports/

# AI answer engine: same access as any other crawler, stated explicitly.
User-agent: OAI-SearchBot
Allow: /

# Authenticated app + machine endpoints (never useful to a crawler)
Disallow: /api/
Disallow: /dashboard
Disallow: /settings
Disallow: /platform
Disallow: /reseller$
Disallow: /reseller/
Disallow: /login
Disallow: /signup
Disallow: /verify-email
Disallow: /update-password
Disallow: /approve-owner
Disallow: /confirm-deletion
Disallow: /oauth/

# Token-scoped tenant share links (hosted invoices, forms, quotes, bookings, e-signature,
# meetings, shared drive links, report views). Public by design, private in substance.
Disallow: /i/
Disallow: /r/
Disallow: /f/
Disallow: /q/
Disallow: /book/
Disallow: /sign/
Disallow: /meet/
Disallow: /drives/l/
Disallow: /reports/

# AI answer engine: same access as any other crawler, stated explicitly.
User-agent: ChatGPT-User
Allow: /

# Authenticated app + machine endpoints (never useful to a crawler)
Disallow: /api/
Disallow: /dashboard
Disallow: /settings
Disallow: /platform
Disallow: /reseller$
Disallow: /reseller/
Disallow: /login
Disallow: /signup
Disallow: /verify-email
Disallow: /update-password
Disallow: /approve-owner
Disallow: /confirm-deletion
Disallow: /oauth/

# Token-scoped tenant share links (hosted invoices, forms, quotes, bookings, e-signature,
# meetings, shared drive links, report views). Public by design, private in substance.
Disallow: /i/
Disallow: /r/
Disallow: /f/
Disallow: /q/
Disallow: /book/
Disallow: /sign/
Disallow: /meet/
Disallow: /drives/l/
Disallow: /reports/

# AI answer engine: same access as any other crawler, stated explicitly.
User-agent: ClaudeBot
Allow: /

# Authenticated app + machine endpoints (never useful to a crawler)
Disallow: /api/
Disallow: /dashboard
Disallow: /settings
Disallow: /platform
Disallow: /reseller$
Disallow: /reseller/
Disallow: /login
Disallow: /signup
Disallow: /verify-email
Disallow: /update-password
Disallow: /approve-owner
Disallow: /confirm-deletion
Disallow: /oauth/

# Token-scoped tenant share links (hosted invoices, forms, quotes, bookings, e-signature,
# meetings, shared drive links, report views). Public by design, private in substance.
Disallow: /i/
Disallow: /r/
Disallow: /f/
Disallow: /q/
Disallow: /book/
Disallow: /sign/
Disallow: /meet/
Disallow: /drives/l/
Disallow: /reports/

# AI answer engine: same access as any other crawler, stated explicitly.
User-agent: Claude-Web
Allow: /

# Authenticated app + machine endpoints (never useful to a crawler)
Disallow: /api/
Disallow: /dashboard
Disallow: /settings
Disallow: /platform
Disallow: /reseller$
Disallow: /reseller/
Disallow: /login
Disallow: /signup
Disallow: /verify-email
Disallow: /update-password
Disallow: /approve-owner
Disallow: /confirm-deletion
Disallow: /oauth/

# Token-scoped tenant share links (hosted invoices, forms, quotes, bookings, e-signature,
# meetings, shared drive links, report views). Public by design, private in substance.
Disallow: /i/
Disallow: /r/
Disallow: /f/
Disallow: /q/
Disallow: /book/
Disallow: /sign/
Disallow: /meet/
Disallow: /drives/l/
Disallow: /reports/

# AI answer engine: same access as any other crawler, stated explicitly.
User-agent: PerplexityBot
Allow: /

# Authenticated app + machine endpoints (never useful to a crawler)
Disallow: /api/
Disallow: /dashboard
Disallow: /settings
Disallow: /platform
Disallow: /reseller$
Disallow: /reseller/
Disallow: /login
Disallow: /signup
Disallow: /verify-email
Disallow: /update-password
Disallow: /approve-owner
Disallow: /confirm-deletion
Disallow: /oauth/

# Token-scoped tenant share links (hosted invoices, forms, quotes, bookings, e-signature,
# meetings, shared drive links, report views). Public by design, private in substance.
Disallow: /i/
Disallow: /r/
Disallow: /f/
Disallow: /q/
Disallow: /book/
Disallow: /sign/
Disallow: /meet/
Disallow: /drives/l/
Disallow: /reports/

# AI answer engine: same access as any other crawler, stated explicitly.
User-agent: Google-Extended
Allow: /

# Authenticated app + machine endpoints (never useful to a crawler)
Disallow: /api/
Disallow: /dashboard
Disallow: /settings
Disallow: /platform
Disallow: /reseller$
Disallow: /reseller/
Disallow: /login
Disallow: /signup
Disallow: /verify-email
Disallow: /update-password
Disallow: /approve-owner
Disallow: /confirm-deletion
Disallow: /oauth/

# Token-scoped tenant share links (hosted invoices, forms, quotes, bookings, e-signature,
# meetings, shared drive links, report views). Public by design, private in substance.
Disallow: /i/
Disallow: /r/
Disallow: /f/
Disallow: /q/
Disallow: /book/
Disallow: /sign/
Disallow: /meet/
Disallow: /drives/l/
Disallow: /reports/

# AI answer engine: same access as any other crawler, stated explicitly.
User-agent: Applebot-Extended
Allow: /

# Authenticated app + machine endpoints (never useful to a crawler)
Disallow: /api/
Disallow: /dashboard
Disallow: /settings
Disallow: /platform
Disallow: /reseller$
Disallow: /reseller/
Disallow: /login
Disallow: /signup
Disallow: /verify-email
Disallow: /update-password
Disallow: /approve-owner
Disallow: /confirm-deletion
Disallow: /oauth/

# Token-scoped tenant share links (hosted invoices, forms, quotes, bookings, e-signature,
# meetings, shared drive links, report views). Public by design, private in substance.
Disallow: /i/
Disallow: /r/
Disallow: /f/
Disallow: /q/
Disallow: /book/
Disallow: /sign/
Disallow: /meet/
Disallow: /drives/l/
Disallow: /reports/

# AI answer engine: same access as any other crawler, stated explicitly.
User-agent: Claude-User
Allow: /

# Authenticated app + machine endpoints (never useful to a crawler)
Disallow: /api/
Disallow: /dashboard
Disallow: /settings
Disallow: /platform
Disallow: /reseller$
Disallow: /reseller/
Disallow: /login
Disallow: /signup
Disallow: /verify-email
Disallow: /update-password
Disallow: /approve-owner
Disallow: /confirm-deletion
Disallow: /oauth/

# Token-scoped tenant share links (hosted invoices, forms, quotes, bookings, e-signature,
# meetings, shared drive links, report views). Public by design, private in substance.
Disallow: /i/
Disallow: /r/
Disallow: /f/
Disallow: /q/
Disallow: /book/
Disallow: /sign/
Disallow: /meet/
Disallow: /drives/l/
Disallow: /reports/

# AI answer engine: same access as any other crawler, stated explicitly.
User-agent: Claude-SearchBot
Allow: /

# Authenticated app + machine endpoints (never useful to a crawler)
Disallow: /api/
Disallow: /dashboard
Disallow: /settings
Disallow: /platform
Disallow: /reseller$
Disallow: /reseller/
Disallow: /login
Disallow: /signup
Disallow: /verify-email
Disallow: /update-password
Disallow: /approve-owner
Disallow: /confirm-deletion
Disallow: /oauth/

# Token-scoped tenant share links (hosted invoices, forms, quotes, bookings, e-signature,
# meetings, shared drive links, report views). Public by design, private in substance.
Disallow: /i/
Disallow: /r/
Disallow: /f/
Disallow: /q/
Disallow: /book/
Disallow: /sign/
Disallow: /meet/
Disallow: /drives/l/
Disallow: /reports/

# AI answer engine: same access as any other crawler, stated explicitly.
User-agent: Perplexity-User
Allow: /

# Authenticated app + machine endpoints (never useful to a crawler)
Disallow: /api/
Disallow: /dashboard
Disallow: /settings
Disallow: /platform
Disallow: /reseller$
Disallow: /reseller/
Disallow: /login
Disallow: /signup
Disallow: /verify-email
Disallow: /update-password
Disallow: /approve-owner
Disallow: /confirm-deletion
Disallow: /oauth/

# Token-scoped tenant share links (hosted invoices, forms, quotes, bookings, e-signature,
# meetings, shared drive links, report views). Public by design, private in substance.
Disallow: /i/
Disallow: /r/
Disallow: /f/
Disallow: /q/
Disallow: /book/
Disallow: /sign/
Disallow: /meet/
Disallow: /drives/l/
Disallow: /reports/

Sitemap: https://www.workbos.com/sitemap.xml