Skip to main content
GET
cURL

Authorizations

Authorization
string
header
required

Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it on your server. Restricted keys carry only the scopes you give them.

Headers

Reflections-Version
string

The dated API version. Defaults to the version your account is pinned to.

Example:

"2026-10-15"

Reflections-Account
string

Act for a connected licensee. The value is the licensee's account ID. Requires an active connection between that account and yours.

Pattern: ^acct_[0-9a-hjkmnp-tv-z]{26}$

Path Parameters

check_id
string
required

The check's ID.

Pattern: ^chk_[0-9a-hjkmnp-tv-z]{26}$

Response

The check. A live check still checking carries Retry-After.

id
string
required

The check's ID, chk_ followed by 26 characters.

Pattern: ^chk_[0-9a-hjkmnp-tv-z]{26}$
object
string
required

Always check.

Allowed value: "check"
livemode
boolean
required

true in live mode, false in test mode.

status
enum<string>
required

Where the check is now. An allow can later become consumed, expired or cancelled; an escalate ends allowed, denied or cancelled.

Available options:
checking,
allowed,
denied,
escalated,
consumed,
expired,
cancelled
decision
enum<string> | null
required

allow, deny or escalate. An escalated check's decision becomes allow or deny when a person decides or the escalation expires. Null while status is checking.

Available options:
allow,
deny,
escalate
talent
object[]
required

Each protected talent the request invokes, with that talent's own decision and license. Empty when none is found.

use
object
required

The use the check decided, as you sent it.

reasons
object[]
required

Why the use was denied or escalated. Empty on allow.

obligations
object[]
required

What you must do to proceed. Empty unless decision is allow.

request_digest
string
required

Digest of the inputs, use and execution this check decided. Without reuse, the authorization covers only this request; with reuse, it also covers later generations of the same use, talent, execution and end user.

Pattern: ^sha256:[0-9a-f]{64}$
created_at
string<date-time>
required

When the check was created.

authorization
object | null

Proof of the allow. Pass token to the tool or provider that generates. Null unless decision is allow.

escalation
object | null

The escalation, when the check is escalated or was decided by a person. When several talent are escalated, each has their own, named in talent[].escalation. While the check is open, this field shows the open one that expires first, so its expires_at is when the check becomes deny. Once decided, it shows the one that decided: the first deny or expiry, or the last allow. The others still open are then cancelled.

remedy
object | null

What would change a deny. Null for other decisions, and when no change can help, as with talent_prohibits.

licensee
string

The account that holds the license: the licensee named in Reflections-Account, or your own account under a platform license.

Pattern: ^acct_[0-9a-hjkmnp-tv-z]{26}$
platform
string

The account that ran the check.

Pattern: ^acct_[0-9a-hjkmnp-tv-z]{26}$
session
string | null

The session this check started, for a check run by POST /v1/sessions. Null otherwise.

Pattern: ^ses_[0-9a-hjkmnp-tv-z]{26}$
receipt
string | null

The receipt that records the decision. Null until an escalated check is decided.

Pattern: ^rcpt_[0-9a-hjkmnp-tv-z]{26}$
metadata
object

Your metadata from the request.