: "${REFLECTIONS_KEY:?Set REFLECTIONS_KEY before running this example}"
curl --fail-with-body --max-time 30 'https://app.reflections.ai/v1/checks/chk_3pg20xkepkscyp0qbpc4yq7ad2' \
-H "Authorization: Bearer $REFLECTIONS_KEY" \
-H "Reflections-Version: 2026-10-15"import { env, exit } from "node:process";
const apiKey = env.REFLECTIONS_KEY;
if (!apiKey) throw new Error("Set REFLECTIONS_KEY before running this example");
const response = await fetch("https://app.reflections.ai/v1/checks/chk_3pg20xkepkscyp0qbpc4yq7ad2", {
method: "GET",
headers: {
Authorization: `Bearer ${apiKey}`,
"Reflections-Version": "2026-10-15",
},
signal: AbortSignal.timeout(30_000),
});
const responseBody = await response.text();
if (!response.ok) {
console.error(`HTTP ${response.status}: ${responseBody}`);
exit(1);
}
console.log(responseBody);
import os
from urllib.error import HTTPError
from urllib.request import Request, urlopen
apiKey = os.environ["REFLECTIONS_KEY"]
if not apiKey:
raise ValueError("Set REFLECTIONS_KEY before running this example")
headers = {
"Authorization": f"Bearer {apiKey}",
"Reflections-Version": "2026-10-15",
}
request = Request("https://app.reflections.ai/v1/checks/chk_3pg20xkepkscyp0qbpc4yq7ad2",
method="GET", headers=headers)
try:
with urlopen(request, timeout=30) as response:
print(response.read().decode("utf-8"))
except HTTPError as error:
error_body = error.read().decode("utf-8")
raise RuntimeError(f"HTTP {error.code}: {error_body}") from error
package main
import (
"fmt"
"io"
"net/http"
"os"
"time"
)
func main() {
apiKey := os.Getenv("REFLECTIONS_KEY")
if apiKey == "" {
panic("Set REFLECTIONS_KEY before running this example")
}
request, err := http.NewRequest("GET", "https://app.reflections.ai/v1/checks/chk_3pg20xkepkscyp0qbpc4yq7ad2", nil)
if err != nil {
panic(err)
}
request.Header.Set("Authorization", "Bearer " + apiKey)
request.Header.Set("Reflections-Version", "2026-10-15")
client := &http.Client{Timeout: 30 * time.Second}
response, err := client.Do(request)
if err != nil {
panic(err)
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
panic(err)
}
if response.StatusCode < 200 || response.StatusCode >= 300 {
panic(fmt.Sprintf("HTTP %d: %s", response.StatusCode, responseBody))
}
fmt.Print(string(responseBody))
}
{
"id": "chk_3m7p4r6s9t0wxyhk5zba2q8v1n",
"object": "check",
"livemode": true,
"status": "checking",
"decision": null,
"talent": [
{
"talent": "tal_9t0wxyhk5zba2q8v1m3n7p4r6s",
"name": "Licensed talent",
"matched_by": "explicit",
"confidence": "exact",
"decision": null,
"facets": [],
"license": "lic_k5zba2q8v1m3n7p4r6s9t0wxyh",
"license_revision": "lrv_p4r6s9t0wxyhk5zba2q8v1m3n7",
"terms_digest": "sha256:39f18c8bef02b5226b9feaa92e526ed30b81b91650d8a10b503281b169f44431",
"escalation": null
}
],
"use": {
"modality": "image",
"kind": "depiction",
"purpose": "advertising",
"commercial": true,
"channels": [
"social",
"web"
],
"territories": [
"US",
"CA"
]
},
"reasons": [],
"obligations": [],
"authorization": null,
"escalation": null,
"remedy": null,
"request_digest": "sha256:bf94817766d56d92211d12f5ff51a3dc1a6d5cb4be2877417b08251fe38c386a",
"licensee": "acct_2q8v1m3n7p4r6s9t0wxyhk5zba",
"platform": "acct_2q8v1m3n7p4r6s9t0wxyhk5zba",
"session": null,
"receipt": null,
"metadata": {},
"created_at": "2026-10-17T18:00:00Z"
}Retrieve a check
Test mode available. Live mode available when configured. Source support does not
establish production activation. Live reads return the caller’s check, including current
authorization consumption or expiry. While evaluation is pending, the check has
status: "checking" and decision: null, with Retry-After. Private details remain available while
pending and for 24 hours after their terminal retention boundary, then return 404.
A check linked to a pending generation remains available through that generation’s window.
In the sandbox and broader protocol, poll an escalated check at most once every 5 seconds.
The initial live implementation requires on_escalate: "deny" and has no request review hold.
Restricted keys need checks:write.
: "${REFLECTIONS_KEY:?Set REFLECTIONS_KEY before running this example}"
curl --fail-with-body --max-time 30 'https://app.reflections.ai/v1/checks/chk_3pg20xkepkscyp0qbpc4yq7ad2' \
-H "Authorization: Bearer $REFLECTIONS_KEY" \
-H "Reflections-Version: 2026-10-15"import { env, exit } from "node:process";
const apiKey = env.REFLECTIONS_KEY;
if (!apiKey) throw new Error("Set REFLECTIONS_KEY before running this example");
const response = await fetch("https://app.reflections.ai/v1/checks/chk_3pg20xkepkscyp0qbpc4yq7ad2", {
method: "GET",
headers: {
Authorization: `Bearer ${apiKey}`,
"Reflections-Version": "2026-10-15",
},
signal: AbortSignal.timeout(30_000),
});
const responseBody = await response.text();
if (!response.ok) {
console.error(`HTTP ${response.status}: ${responseBody}`);
exit(1);
}
console.log(responseBody);
import os
from urllib.error import HTTPError
from urllib.request import Request, urlopen
apiKey = os.environ["REFLECTIONS_KEY"]
if not apiKey:
raise ValueError("Set REFLECTIONS_KEY before running this example")
headers = {
"Authorization": f"Bearer {apiKey}",
"Reflections-Version": "2026-10-15",
}
request = Request("https://app.reflections.ai/v1/checks/chk_3pg20xkepkscyp0qbpc4yq7ad2",
method="GET", headers=headers)
try:
with urlopen(request, timeout=30) as response:
print(response.read().decode("utf-8"))
except HTTPError as error:
error_body = error.read().decode("utf-8")
raise RuntimeError(f"HTTP {error.code}: {error_body}") from error
package main
import (
"fmt"
"io"
"net/http"
"os"
"time"
)
func main() {
apiKey := os.Getenv("REFLECTIONS_KEY")
if apiKey == "" {
panic("Set REFLECTIONS_KEY before running this example")
}
request, err := http.NewRequest("GET", "https://app.reflections.ai/v1/checks/chk_3pg20xkepkscyp0qbpc4yq7ad2", nil)
if err != nil {
panic(err)
}
request.Header.Set("Authorization", "Bearer " + apiKey)
request.Header.Set("Reflections-Version", "2026-10-15")
client := &http.Client{Timeout: 30 * time.Second}
response, err := client.Do(request)
if err != nil {
panic(err)
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
panic(err)
}
if response.StatusCode < 200 || response.StatusCode >= 300 {
panic(fmt.Sprintf("HTTP %d: %s", response.StatusCode, responseBody))
}
fmt.Print(string(responseBody))
}
{
"id": "chk_3m7p4r6s9t0wxyhk5zba2q8v1n",
"object": "check",
"livemode": true,
"status": "checking",
"decision": null,
"talent": [
{
"talent": "tal_9t0wxyhk5zba2q8v1m3n7p4r6s",
"name": "Licensed talent",
"matched_by": "explicit",
"confidence": "exact",
"decision": null,
"facets": [],
"license": "lic_k5zba2q8v1m3n7p4r6s9t0wxyh",
"license_revision": "lrv_p4r6s9t0wxyhk5zba2q8v1m3n7",
"terms_digest": "sha256:39f18c8bef02b5226b9feaa92e526ed30b81b91650d8a10b503281b169f44431",
"escalation": null
}
],
"use": {
"modality": "image",
"kind": "depiction",
"purpose": "advertising",
"commercial": true,
"channels": [
"social",
"web"
],
"territories": [
"US",
"CA"
]
},
"reasons": [],
"obligations": [],
"authorization": null,
"escalation": null,
"remedy": null,
"request_digest": "sha256:bf94817766d56d92211d12f5ff51a3dc1a6d5cb4be2877417b08251fe38c386a",
"licensee": "acct_2q8v1m3n7p4r6s9t0wxyhk5zba",
"platform": "acct_2q8v1m3n7p4r6s9t0wxyhk5zba",
"session": null,
"receipt": null,
"metadata": {},
"created_at": "2026-10-17T18:00:00Z"
}Authorizations
Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it
on your server. Restricted keys carry only the scopes you give them.
Headers
The dated API version. Defaults to the version your account is pinned to.
"2026-10-15"
Act for a connected licensee. The value is the licensee's account ID. Requires an active connection between that account and yours.
^acct_[0-9a-hjkmnp-tv-z]{26}$Path Parameters
The check's ID.
^chk_[0-9a-hjkmnp-tv-z]{26}$Response
The check. A live check still checking carries Retry-After.
The check's ID, chk_ followed by 26 characters.
^chk_[0-9a-hjkmnp-tv-z]{26}$Always check.
"check"true in live mode, false in test mode.
Where the check is now. An allow can later become consumed, expired or
cancelled; an escalate ends allowed, denied or cancelled.
checking, allowed, denied, escalated, consumed, expired, cancelled allow, deny or escalate. An escalated check's decision becomes allow or deny
when a person decides or the escalation expires. Null while status is checking.
allow, deny, escalate Each protected talent the request invokes, with that talent's own decision and license. Empty when none is found.
Show child attributes
Show child attributes
The use the check decided, as you sent it.
Show child attributes
Show child attributes
Why the use was denied or escalated. Empty on allow.
Show child attributes
Show child attributes
What you must do to proceed. Empty unless decision is allow.
Show child attributes
Show child attributes
Digest of the inputs, use and execution this check decided. Without reuse, the authorization covers only this request; with reuse, it also covers later generations of the same use, talent, execution and end user.
^sha256:[0-9a-f]{64}$When the check was created.
Proof of the allow. Pass token to the tool or provider that generates. Null unless
decision is allow.
Show child attributes
Show child attributes
The escalation, when the check is escalated or was decided by a person. When several
talent are escalated, each has their own, named in talent[].escalation. While the
check is open, this field shows the open one that expires first, so its expires_at is
when the check becomes deny. Once decided, it shows the one that decided: the first
deny or expiry, or the last allow. The others still open are then cancelled.
Show child attributes
Show child attributes
What would change a deny. Null for other decisions, and when no change can help, as
with talent_prohibits.
Show child attributes
Show child attributes
The account that holds the license: the licensee named in Reflections-Account, or your
own account under a platform license.
^acct_[0-9a-hjkmnp-tv-z]{26}$The account that ran the check.
^acct_[0-9a-hjkmnp-tv-z]{26}$The session this check started, for a check run by POST /v1/sessions. Null otherwise.
^ses_[0-9a-hjkmnp-tv-z]{26}$The receipt that records the decision. Null until an escalated check is decided.
^rcpt_[0-9a-hjkmnp-tv-z]{26}$Your metadata from the request.
Show child attributes
Show child attributes