Sort:  

Just don't allow users (bots) who are directly interacting with the api to flag? :)