Proactive bot defense and JSON entities

Hello,

Since the bot defense needs to send javascript to challenge requestors, what is the way to do this protection kind to a JSON content type resources? Does it have any workaround to detect and block bots to a non-HTML entities?

e.g.:

In case I have a JSON logon page, how to prevent the bot requests, more than just setup a brute force protection to that logon page?

How to protect against bot with ASM, when you have a json api services?

Thank you in advance,