Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it on your server. Restricted keys carry only the scopes you give them.

Headers

Reflections-Version
string

The dated API version. Defaults to the version your account is pinned to.

Example:

"2026-10-15"

Idempotency-Key
string

A unique key for this operation, up to 255 characters. In test mode, POST keys are scoped to your account and mode and bind the endpoint and body for 24 hours. A different endpoint or body with the same key is refused.

Initial live check and generation creation require a nonempty key. Each operation has a separate account-scoped namespace; retain the same API key, body and idempotency key for retries within 24 hours of creation. A pending check returns 202 with status: "checking". Completed checks replay their sealed response; successful generation POSTs replay the original accepted 202, so use GET for current state. Live verification is a read-only query that returns a fresh verification ID on each call, without exact response caching.

The broader delegated-account contract also scopes keys to Reflections-Account; delegated requests and the other planned live POST operations remain unsupported.

Maximum string length: 255

Path Parameters

event_id
string
required

The event's ID, equal to the webhook-id header of its deliveries.

Pattern: ^evt_[0-9a-hjkmnp-tv-z]{26}$

Body

application/json
endpoint
string

Resend only to this endpoint.

Pattern: ^we_[0-9a-hjkmnp-tv-z]{26}$

Response

The event, queued for delivery.

An event of any type. type names it, and data.object is the object that type carries.

id
string
required

Equal to the webhook-id header.

Pattern: ^evt_[0-9a-hjkmnp-tv-z]{26}$
object
string
required

Always event.

Allowed value: "event"
type
enum<string>
required

The event type, one of the license.* event types.

Available options:
license.issued,
license.accepted,
license.revised,
license.revision_pending,
license.revision_declined,
license.suspended,
license.resumed,
license.revoked,
license.expired,
license.declined
api_version
string
required

The API version data.object is rendered in.

livemode
boolean
required

true for live events, false for test events.

sequence
integer
required

Increases by one with each event about the same object. Ignore an event whose sequence is lower than one you have processed.

created_at
string<date-time>
required

When the event happened.

data
object
required

The license in object and, when the event changed it, the old values of the changed fields in previous_attributes.

account
string | null

The connected licensee the event concerns, when it is not your own account.

Pattern: ^acct_[0-9a-hjkmnp-tv-z]{26}$