# Set a unique key once per new action; persist it and reuse it for every retry.
: "${REFLECTIONS_KEY:?Set REFLECTIONS_KEY before running this example}"
: "${REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY:?Set REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY before running this example}"
curl --fail-with-body --max-time 30 -X POST 'https://app.reflections.ai/v1/generations/gen_2q8v1m3n7p4r6s9t0wxyhk5zba/withdraw' \
-H "Authorization: Bearer $REFLECTIONS_KEY" \
-H "Reflections-Version: 2026-10-15" \
-H "Idempotency-Key: $REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY"import { env, exit } from "node:process";
// Set a unique key once per new action; persist it and reuse it for every retry.
const apiKey = env.REFLECTIONS_KEY;
if (!apiKey) throw new Error("Set REFLECTIONS_KEY before running this example");
const idempotencyKey = env.REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY;
if (!idempotencyKey) throw new Error("Set REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY before running this example");
const response = await fetch("https://app.reflections.ai/v1/generations/gen_2q8v1m3n7p4r6s9t0wxyhk5zba/withdraw", {
method: "POST",
headers: {
Authorization: `Bearer ${apiKey}`,
"Reflections-Version": "2026-10-15",
"Idempotency-Key": idempotencyKey,
},
signal: AbortSignal.timeout(30_000),
});
const responseBody = await response.text();
if (!response.ok) {
console.error(`HTTP ${response.status}: ${responseBody}`);
exit(1);
}
console.log(responseBody);
import os
from urllib.error import HTTPError
from urllib.request import Request, urlopen
# Set a unique key once per new action; persist it and reuse it for every retry.
apiKey = os.environ["REFLECTIONS_KEY"]
if not apiKey:
raise ValueError("Set REFLECTIONS_KEY before running this example")
idempotencyKey = os.environ["REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY"]
if not idempotencyKey:
raise ValueError("Set REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY before running this example")
headers = {
"Authorization": f"Bearer {apiKey}",
"Reflections-Version": "2026-10-15",
"Idempotency-Key": idempotencyKey,
}
request = Request("https://app.reflections.ai/v1/generations/gen_2q8v1m3n7p4r6s9t0wxyhk5zba/withdraw",
method="POST", headers=headers)
try:
with urlopen(request, timeout=30) as response:
print(response.read().decode("utf-8"))
except HTTPError as error:
error_body = error.read().decode("utf-8")
raise RuntimeError(f"HTTP {error.code}: {error_body}") from error
package main
import (
"fmt"
"io"
"net/http"
"os"
"time"
)
func main() {
// Set a unique key once per new action; persist it and reuse it for every retry.
apiKey := os.Getenv("REFLECTIONS_KEY")
if apiKey == "" {
panic("Set REFLECTIONS_KEY before running this example")
}
idempotencyKey := os.Getenv("REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY")
if idempotencyKey == "" {
panic("Set REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY before running this example")
}
request, err := http.NewRequest("POST", "https://app.reflections.ai/v1/generations/gen_2q8v1m3n7p4r6s9t0wxyhk5zba/withdraw", nil)
if err != nil {
panic(err)
}
request.Header.Set("Authorization", "Bearer " + apiKey)
request.Header.Set("Reflections-Version", "2026-10-15")
request.Header.Set("Idempotency-Key", idempotencyKey)
client := &http.Client{Timeout: 30 * time.Second}
response, err := client.Do(request)
if err != nil {
panic(err)
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
panic(err)
}
if response.StatusCode < 200 || response.StatusCode >= 300 {
panic(fmt.Sprintf("HTTP %d: %s", response.StatusCode, responseBody))
}
fmt.Print(string(responseBody))
}
{
"id": "gen_0syye78tm8qdvre87y0wnvmfcs",
"object": "generation",
"livemode": true,
"check": "chk_3m7p4r6s9t0wxyhk5zba2q8v1n",
"session": null,
"candidate_index": 2,
"status": "withdrawn",
"decision": "escalate",
"artifact": {
"file": "file_cf9vex7e3amaf4ph46kks9mp4w",
"sha256": "a75e83bb3668a35e7ecf2c2ad75f65999ac134519348cc4d2981030353c0930b",
"media_type": "image/png",
"duration_ms": null
},
"execution": {
"provider": "example-image-provider",
"model": "image-model-3",
"job_id": "job_88215"
},
"findings": [
{
"term": "license:lic_k5zba2q8v1m3n7p4r6s9t0wxyh/terms.requiredAttributes",
"attribute": "identity.samePerson",
"result": "preserved"
},
{
"term": "license:lic_k5zba2q8v1m3n7p4r6s9t0wxyh/terms.adjustments",
"attribute": "appearance.wardrobe",
"result": "preserved"
},
{
"term": "license:lic_k5zba2q8v1m3n7p4r6s9t0wxyh/terms.neverExtras",
"rule": "Do not show alcohol or tobacco.",
"result": "preserved"
}
],
"unchecked_terms": [],
"reasons": [],
"obligations": [
{
"type": "hold_until_release",
"reviewer": "talent"
},
{
"type": "draft_watermark"
}
],
"escalation": {
"id": "esc_f5zx603y7xn526k4asxrdtasxj",
"reason": "release_review",
"reviewer": "talent",
"status": "cancelled",
"expires_at": "2026-10-24T18:03:05Z",
"resolved_at": "2026-10-18T09:15:00Z",
"note": null
},
"assurance": "observed",
"receipt": null,
"c2pa": null,
"watermark": null,
"metadata": {},
"created_at": "2026-10-17T18:03:05Z",
"decided_at": null
}{
"type": "https://docs.reflections.ai/errors/invalid_api_key",
"title": "The API key is not valid",
"status": 401,
"code": "invalid_api_key",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/account_not_connected",
"title": "The licensee has not connected your platform",
"status": 403,
"code": "account_not_connected",
"detail": "acct_2q8v1m3n7p4r6s9t0wxyhk5zba has no active connection with your account.",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/resource_not_found",
"title": "No such object",
"status": 404,
"code": "resource_not_found",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/idempotency_key_in_use",
"title": "A request with this key is still running",
"status": 409,
"code": "idempotency_key_in_use",
"detail": "Retry with the same key after a short wait.",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/idempotency_key_reused",
"title": "This key was used for a different request",
"status": 422,
"code": "idempotency_key_reused",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/rate_limited",
"title": "Too many requests",
"status": 429,
"code": "rate_limited",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}Withdraw a generation
Test mode available. Live mode unavailable. Uses fictional sandbox data only. See Sandbox for the supported forms and limits.
Withdraws an output from review, or records that a released output is no longer in use. A held output that is withdrawn returns its delivery to the license’s delivery limit.
The generation’s status becomes withdrawn. Its receipt’s use_status does not change: on a
receipt, withdrawn means a revocation requires the output to be taken down, which only the
talent’s revocation sets.
Restricted keys need generations:write.
# Set a unique key once per new action; persist it and reuse it for every retry.
: "${REFLECTIONS_KEY:?Set REFLECTIONS_KEY before running this example}"
: "${REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY:?Set REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY before running this example}"
curl --fail-with-body --max-time 30 -X POST 'https://app.reflections.ai/v1/generations/gen_2q8v1m3n7p4r6s9t0wxyhk5zba/withdraw' \
-H "Authorization: Bearer $REFLECTIONS_KEY" \
-H "Reflections-Version: 2026-10-15" \
-H "Idempotency-Key: $REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY"import { env, exit } from "node:process";
// Set a unique key once per new action; persist it and reuse it for every retry.
const apiKey = env.REFLECTIONS_KEY;
if (!apiKey) throw new Error("Set REFLECTIONS_KEY before running this example");
const idempotencyKey = env.REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY;
if (!idempotencyKey) throw new Error("Set REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY before running this example");
const response = await fetch("https://app.reflections.ai/v1/generations/gen_2q8v1m3n7p4r6s9t0wxyhk5zba/withdraw", {
method: "POST",
headers: {
Authorization: `Bearer ${apiKey}`,
"Reflections-Version": "2026-10-15",
"Idempotency-Key": idempotencyKey,
},
signal: AbortSignal.timeout(30_000),
});
const responseBody = await response.text();
if (!response.ok) {
console.error(`HTTP ${response.status}: ${responseBody}`);
exit(1);
}
console.log(responseBody);
import os
from urllib.error import HTTPError
from urllib.request import Request, urlopen
# Set a unique key once per new action; persist it and reuse it for every retry.
apiKey = os.environ["REFLECTIONS_KEY"]
if not apiKey:
raise ValueError("Set REFLECTIONS_KEY before running this example")
idempotencyKey = os.environ["REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY"]
if not idempotencyKey:
raise ValueError("Set REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY before running this example")
headers = {
"Authorization": f"Bearer {apiKey}",
"Reflections-Version": "2026-10-15",
"Idempotency-Key": idempotencyKey,
}
request = Request("https://app.reflections.ai/v1/generations/gen_2q8v1m3n7p4r6s9t0wxyhk5zba/withdraw",
method="POST", headers=headers)
try:
with urlopen(request, timeout=30) as response:
print(response.read().decode("utf-8"))
except HTTPError as error:
error_body = error.read().decode("utf-8")
raise RuntimeError(f"HTTP {error.code}: {error_body}") from error
package main
import (
"fmt"
"io"
"net/http"
"os"
"time"
)
func main() {
// Set a unique key once per new action; persist it and reuse it for every retry.
apiKey := os.Getenv("REFLECTIONS_KEY")
if apiKey == "" {
panic("Set REFLECTIONS_KEY before running this example")
}
idempotencyKey := os.Getenv("REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY")
if idempotencyKey == "" {
panic("Set REFLECTIONS_WITHDRAW_GENERATION_IDEMPOTENCY_KEY before running this example")
}
request, err := http.NewRequest("POST", "https://app.reflections.ai/v1/generations/gen_2q8v1m3n7p4r6s9t0wxyhk5zba/withdraw", nil)
if err != nil {
panic(err)
}
request.Header.Set("Authorization", "Bearer " + apiKey)
request.Header.Set("Reflections-Version", "2026-10-15")
request.Header.Set("Idempotency-Key", idempotencyKey)
client := &http.Client{Timeout: 30 * time.Second}
response, err := client.Do(request)
if err != nil {
panic(err)
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
panic(err)
}
if response.StatusCode < 200 || response.StatusCode >= 300 {
panic(fmt.Sprintf("HTTP %d: %s", response.StatusCode, responseBody))
}
fmt.Print(string(responseBody))
}
{
"id": "gen_0syye78tm8qdvre87y0wnvmfcs",
"object": "generation",
"livemode": true,
"check": "chk_3m7p4r6s9t0wxyhk5zba2q8v1n",
"session": null,
"candidate_index": 2,
"status": "withdrawn",
"decision": "escalate",
"artifact": {
"file": "file_cf9vex7e3amaf4ph46kks9mp4w",
"sha256": "a75e83bb3668a35e7ecf2c2ad75f65999ac134519348cc4d2981030353c0930b",
"media_type": "image/png",
"duration_ms": null
},
"execution": {
"provider": "example-image-provider",
"model": "image-model-3",
"job_id": "job_88215"
},
"findings": [
{
"term": "license:lic_k5zba2q8v1m3n7p4r6s9t0wxyh/terms.requiredAttributes",
"attribute": "identity.samePerson",
"result": "preserved"
},
{
"term": "license:lic_k5zba2q8v1m3n7p4r6s9t0wxyh/terms.adjustments",
"attribute": "appearance.wardrobe",
"result": "preserved"
},
{
"term": "license:lic_k5zba2q8v1m3n7p4r6s9t0wxyh/terms.neverExtras",
"rule": "Do not show alcohol or tobacco.",
"result": "preserved"
}
],
"unchecked_terms": [],
"reasons": [],
"obligations": [
{
"type": "hold_until_release",
"reviewer": "talent"
},
{
"type": "draft_watermark"
}
],
"escalation": {
"id": "esc_f5zx603y7xn526k4asxrdtasxj",
"reason": "release_review",
"reviewer": "talent",
"status": "cancelled",
"expires_at": "2026-10-24T18:03:05Z",
"resolved_at": "2026-10-18T09:15:00Z",
"note": null
},
"assurance": "observed",
"receipt": null,
"c2pa": null,
"watermark": null,
"metadata": {},
"created_at": "2026-10-17T18:03:05Z",
"decided_at": null
}{
"type": "https://docs.reflections.ai/errors/invalid_api_key",
"title": "The API key is not valid",
"status": 401,
"code": "invalid_api_key",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/account_not_connected",
"title": "The licensee has not connected your platform",
"status": 403,
"code": "account_not_connected",
"detail": "acct_2q8v1m3n7p4r6s9t0wxyhk5zba has no active connection with your account.",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/resource_not_found",
"title": "No such object",
"status": 404,
"code": "resource_not_found",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/idempotency_key_in_use",
"title": "A request with this key is still running",
"status": 409,
"code": "idempotency_key_in_use",
"detail": "Retry with the same key after a short wait.",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/idempotency_key_reused",
"title": "This key was used for a different request",
"status": 422,
"code": "idempotency_key_reused",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/rate_limited",
"title": "Too many requests",
"status": 429,
"code": "rate_limited",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}Authorizations
Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it
on your server. Restricted keys carry only the scopes you give them.
Headers
The dated API version. Defaults to the version your account is pinned to.
"2026-10-15"
Act for a connected licensee. The value is the licensee's account ID. Requires an active connection between that account and yours.
^acct_[0-9a-hjkmnp-tv-z]{26}$A unique key for this operation, up to 255 characters. In test mode, POST keys are scoped to your account and mode and bind the endpoint and body for 24 hours. A different endpoint or body with the same key is refused.
Initial live check and generation creation require a nonempty key. Each operation has a
separate account-scoped namespace; retain the same API key, body and idempotency key for
retries within 24 hours of creation. A pending check returns 202 with status: "checking".
Completed checks replay their sealed response; successful generation POSTs replay the
original accepted 202, so use GET for current state. Live verification is a read-only
query that returns a fresh verification ID on each call, without exact response caching.
The broader delegated-account contract also scopes keys to Reflections-Account;
delegated requests and the other planned live POST operations remain unsupported.
255Path Parameters
The generation's ID.
^gen_[0-9a-hjkmnp-tv-z]{26}$Response
The withdrawn generation.
The generation's ID, gen_ followed by 26 characters.
^gen_[0-9a-hjkmnp-tv-z]{26}$Always generation.
"generation"true in live mode, false in test mode.
Where the output is. Deliver only on allowed or released.
checking, allowed, denied, held, released, expired, withdrawn observed: Reflections checked these bytes. attested: Reflections recorded what you stated without checking it.
observed, attested When the output was submitted.
The check the output was made under. Null for an output made in a session.
^chk_[0-9a-hjkmnp-tv-z]{26}$The session the output was made in. Null for an output made under a check.
^ses_[0-9a-hjkmnp-tv-z]{26}$Which of the check's candidates this is, from 0. Null under reuse and for an output
made in a session.
allow, deny, or escalate while a reviewer must release the output. Null while
status is checking.
allow, deny, escalate The output that was checked.
Show child attributes
Show child attributes
The run that made the output, as you stated it.
Show child attributes
Show child attributes
Each rule checked on the bytes, with its result.
Show child attributes
Show child attributes
Addresses of rules the talent wrote that could not be checked on these bytes. They do not withhold the output.
Where a reason or finding rests, written as an address: license:<id>/terms.<key> for a
term, talent:<id> for a talent's standing boundary.
Why the output was denied or expired. Empty otherwise.
Show child attributes
Show child attributes
What you must do with this output, such as embed c2pa and show the disclosure, or keep
it private while held.
Show child attributes
Show child attributes
The release review, when a person must release the output. Null otherwise.
Show child attributes
Show child attributes
The receipt that records the decision. Null while the output is checking or held,
and after a withdrawal from review.
^rcpt_[0-9a-hjkmnp-tv-z]{26}$The assertion to embed in the output's C2PA manifest before you deliver it. Null unless
decision is allow.
Show child attributes
Show child attributes
The watermark you registered on the generation. Null if none.
Show child attributes
Show child attributes
Your metadata from the request.
Show child attributes
Show child attributes
When the output was allowed, released, denied or expired. Null otherwise.