Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it on your server. Restricted keys carry only the scopes you give them.

Headers

Reflections-Version
string

The dated API version. Defaults to the version your account is pinned to.

Example:

"2026-10-15"

Reflections-Account
string

Act for a connected licensee. The value is the licensee's account ID. Requires an active connection between that account and yours.

Pattern: ^acct_[0-9a-hjkmnp-tv-z]{26}$
Idempotency-Key
string

A unique key for this operation, up to 255 characters. In test mode, POST keys are scoped to your account and mode and bind the endpoint and body for 24 hours. A different endpoint or body with the same key is refused.

Initial live check and generation creation require a nonempty key. Each operation has a separate account-scoped namespace; retain the same API key, body and idempotency key for retries within 24 hours of creation. A pending check returns 202 with status: "checking". Completed checks replay their sealed response; successful generation POSTs replay the original accepted 202, so use GET for current state. Live verification is a read-only query that returns a fresh verification ID on each call, without exact response caching.

The broader delegated-account contract also scopes keys to Reflections-Account; delegated requests and the other planned live POST operations remain unsupported.

Maximum string length: 255

Body

application/json
check
string
required

The check this output was made under. Required unless session is set.

Pattern: ^chk_[0-9a-hjkmnp-tv-z]{26}$
artifact
object
required

The output's bytes, as a file ID, a URL or base64 data, with their SHA-256.

session
string

The session this output was made in, instead of a check.

Pattern: ^ses_[0-9a-hjkmnp-tv-z]{26}$
candidate_index
integer

Which of the check's execution.candidates this is, from 0. Omit under reuse.

Required range: 0 <= x <= 15
execution
object

The run that made the output. Send job_id when the provider gives one.

transcript
string

Words spoken in the output, if you have them. Reflections transcribes regardless.

Maximum string length: 32000
watermark
object

A watermark you applied, so verification can join it to this generation.

c2pa_signer
object

The certificate that will sign the output's C2PA claim. The receipt signs its thumbprint as tlp.c2pa_signer, as given; Reflections does not check it against a certificate. A verifier that checks the manifest can then reject the assertion in a manifest another certificate signed. Without it, the receipt is evidence of a decision, not of a particular file.

metadata
object

Your own keys, returned on the generation.

Response

The generation.

id
string
required

The generation's ID, gen_ followed by 26 characters.

Pattern: ^gen_[0-9a-hjkmnp-tv-z]{26}$
object
string
required

Always generation.

Allowed value: "generation"
livemode
boolean
required

true in live mode, false in test mode.

status
enum<string>
required

Where the output is. Deliver only on allowed or released.

Available options:
checking,
allowed,
denied,
held,
released,
expired,
withdrawn
assurance
enum<string>
required

observed: Reflections checked these bytes. attested: Reflections recorded what you stated without checking it.

Available options:
observed,
attested
created_at
string<date-time>
required

When the output was submitted.

check
string | null

The check the output was made under. Null for an output made in a session.

Pattern: ^chk_[0-9a-hjkmnp-tv-z]{26}$
session
string | null

The session the output was made in. Null for an output made under a check.

Pattern: ^ses_[0-9a-hjkmnp-tv-z]{26}$
candidate_index
integer | null

Which of the check's candidates this is, from 0. Null under reuse and for an output made in a session.

decision
enum<string> | null

allow, deny, or escalate while a reviewer must release the output. Null while status is checking.

Available options:
allow,
deny,
escalate
artifact
object | null

The output that was checked.

execution
object

The run that made the output, as you stated it.

findings
object[]

Each rule checked on the bytes, with its result.

unchecked_terms
string[]

Addresses of rules the talent wrote that could not be checked on these bytes. They do not withhold the output.

Where a reason or finding rests, written as an address: license:<id>/terms.<key> for a term, talent:<id> for a talent's standing boundary.

reasons
object[]

Why the output was denied or expired. Empty otherwise.

obligations
object[]

What you must do with this output, such as embed c2pa and show the disclosure, or keep it private while held.

escalation
object | null

The release review, when a person must release the output. Null otherwise.

receipt
string | null

The receipt that records the decision. Null while the output is checking or held, and after a withdrawal from review.

Pattern: ^rcpt_[0-9a-hjkmnp-tv-z]{26}$
c2pa
object | null

The assertion to embed in the output's C2PA manifest before you deliver it. Null unless decision is allow.

watermark
object | null

The watermark you registered on the generation. Null if none.

metadata
object

Your metadata from the request.

decided_at
string<date-time> | null

When the output was allowed, released, denied or expired. Null otherwise.