They can't whitelist useragent, otherwise bot will pass just using agent spoofing.

If you have enterprise plan, you can have custom rules including allowing by url