Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it on your server. Restricted keys carry only the scopes you give them.

Headers

Reflections-Version
string

The dated API version. Defaults to the version your account is pinned to.

Example:

"2026-10-15"

Idempotency-Key
string

A unique key for this operation, up to 255 characters. In test mode, POST keys are scoped to your account and mode and bind the endpoint and body for 24 hours. A different endpoint or body with the same key is refused.

Initial live check and generation creation require a nonempty key. Each operation has a separate account-scoped namespace; retain the same API key, body and idempotency key for retries within 24 hours of creation. A pending check returns 202 with status: "checking". Completed checks replay their sealed response; successful generation POSTs replay the original accepted 202, so use GET for current state. Live verification is a read-only query that returns a fresh verification ID on each call, without exact response caching.

The broader delegated-account contract also scopes keys to Reflections-Account; delegated requests and the other planned live POST operations remain unsupported.

Maximum string length: 255

Body

application/json
code
string
required

The code your redirect URI received.

Maximum string length: 256
code_verifier
string
required

The PKCE verifier whose S256 challenge you sent to the authorization endpoint.

Required string length: 43 - 128
redirect_uri
string<uri>
required

The redirect URI you sent to the authorization endpoint, character for character.

Response

The new connection.

id
string
required

Unique identifier for the connection, con_….

Pattern: ^con_[0-9a-hjkmnp-tv-z]{26}$
object
string
required

Always connection.

Allowed value: "connection"
livemode
boolean
required

true for a live-mode connection, false for a test-mode one.

status
enum<string>
required

active while the platform may act for the licensee. revoked once the licensee, the platform or Reflections ended it.

Available options:
active,
revoked
licensee
string
required

The account whose licenses the platform may use. Send it in Reflections-Account.

Pattern: ^acct_[0-9a-hjkmnp-tv-z]{26}$
platform
string
required

The platform account that acts for the licensee.

Pattern: ^acct_[0-9a-hjkmnp-tv-z]{26}$
scopes
enum<string>[]
required

What the platform may do for the licensee, as approved through OAuth. A call that needs a scope not listed fails with 403 account_not_connected.

Available options:
talent:read,
licenses:read,
license_requests:write,
files:write,
checks:write,
generations:write,
sessions:write,
revocations:write,
usage:write,
statements:read
licenses
object
required

Which of the licensee's licenses the platform may use.

created_at
string<date-time>
required

When the licensee approved the connection.

licensee_name
string

The licensee's account name.

platform_name
string

The platform's display_name, as the licensee saw it when approving.

revoked_by
enum<string> | null

Who ended the connection. null while it is active.

Available options:
licensee,
platform,
reflections,
null
revoked_at
string<date-time> | null

When the connection ended. From then, calls for the licensee fail with account_not_connected. null while it is active.