# Set a unique key once per new action; persist it and reuse it for every retry.
: "${REFLECTIONS_KEY:?Set REFLECTIONS_KEY before running this example}"
: "${REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY:?Set REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY before running this example}"
curl --fail-with-body --max-time 30 -X POST 'https://app.reflections.ai/v1/revocations' \
-H "Authorization: Bearer $REFLECTIONS_KEY" \
-H "Reflections-Version: 2026-10-15" \
-H "Idempotency-Key: $REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY" \
-H "Content-Type: application/json" \
--data-raw '{
"license": "lic_31x87g772xdcz1n1za29601rbt",
"note": "The campaign ended early."
}'import { env, exit } from "node:process";
// Set a unique key once per new action; persist it and reuse it for every retry.
const apiKey = env.REFLECTIONS_KEY;
if (!apiKey) throw new Error("Set REFLECTIONS_KEY before running this example");
const idempotencyKey = env.REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY;
if (!idempotencyKey) throw new Error("Set REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY before running this example");
const response = await fetch("https://app.reflections.ai/v1/revocations", {
method: "POST",
headers: {
Authorization: `Bearer ${apiKey}`,
"Reflections-Version": "2026-10-15",
"Idempotency-Key": idempotencyKey,
"Content-Type": "application/json",
},
body: JSON.stringify({
"license": "lic_31x87g772xdcz1n1za29601rbt",
"note": "The campaign ended early."
}),
signal: AbortSignal.timeout(30_000),
});
const responseBody = await response.text();
if (!response.ok) {
console.error(`HTTP ${response.status}: ${responseBody}`);
exit(1);
}
console.log(responseBody);
import json
import os
from urllib.error import HTTPError
from urllib.request import Request, urlopen
# Set a unique key once per new action; persist it and reuse it for every retry.
apiKey = os.environ["REFLECTIONS_KEY"]
if not apiKey:
raise ValueError("Set REFLECTIONS_KEY before running this example")
idempotencyKey = os.environ["REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY"]
if not idempotencyKey:
raise ValueError("Set REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY before running this example")
headers = {
"Authorization": f"Bearer {apiKey}",
"Reflections-Version": "2026-10-15",
"Idempotency-Key": idempotencyKey,
"Content-Type": "application/json",
}
data = json.dumps({"license": "lic_31x87g772xdcz1n1za29601rbt", "note": "The campaign ended early."}).encode("utf-8")
request = Request("https://app.reflections.ai/v1/revocations",
method="POST", headers=headers, data=data)
try:
with urlopen(request, timeout=30) as response:
print(response.read().decode("utf-8"))
except HTTPError as error:
error_body = error.read().decode("utf-8")
raise RuntimeError(f"HTTP {error.code}: {error_body}") from error
package main
import (
"fmt"
"io"
"net/http"
"os"
"strings"
"time"
)
func main() {
// Set a unique key once per new action; persist it and reuse it for every retry.
apiKey := os.Getenv("REFLECTIONS_KEY")
if apiKey == "" {
panic("Set REFLECTIONS_KEY before running this example")
}
idempotencyKey := os.Getenv("REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY")
if idempotencyKey == "" {
panic("Set REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY before running this example")
}
body := strings.NewReader(`{
"license": "lic_31x87g772xdcz1n1za29601rbt",
"note": "The campaign ended early."
}`)
request, err := http.NewRequest("POST", "https://app.reflections.ai/v1/revocations", body)
if err != nil {
panic(err)
}
request.Header.Set("Authorization", "Bearer " + apiKey)
request.Header.Set("Reflections-Version", "2026-10-15")
request.Header.Set("Idempotency-Key", idempotencyKey)
request.Header.Set("Content-Type", "application/json")
client := &http.Client{Timeout: 30 * time.Second}
response, err := client.Do(request)
if err != nil {
panic(err)
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
panic(err)
}
if response.StatusCode < 200 || response.StatusCode >= 300 {
panic(fmt.Sprintf("HTTP %d: %s", response.StatusCode, responseBody))
}
fmt.Print(string(responseBody))
}
{
"id": "rvk_1dxf6bkeqxsyw32j28wymgav5q",
"object": "revocation",
"livemode": false,
"scope": "license",
"targets": {
"talent": "tal_4n6p8r0t2v4x6z8b0d2f4h6j8k",
"licenses": [
"lic_31x87g772xdcz1n1za29601rbt"
],
"facets": [],
"mandate": null
},
"status": "pending_acknowledgement",
"initiated_by": "representative",
"for_cause": false,
"cause": null,
"note": "The campaign ended early.",
"effective_at": "2026-10-17T19:12:05Z",
"post_revocation": {
"policy": "retain",
"withdraw_by": null
},
"required_actions": [
"stop_generation",
"purge_cached_decisions"
],
"provider_copies": [],
"affected": {
"checks_denied": 0,
"generations_denied": 2,
"sessions_terminated": 0,
"released_outputs": 5
},
"acknowledge_by": "2026-10-18T19:12:05Z",
"acknowledgements": [],
"created_at": "2026-10-17T19:12:05Z"
}{
"type": "https://docs.reflections.ai/errors/parameter_invalid",
"title": "A parameter is invalid",
"status": 400,
"code": "parameter_invalid",
"param": "use.territories[1]",
"detail": "\"UK\" is not an ISO 3166-1 alpha-2 code. Use \"GB\".",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/invalid_api_key",
"title": "The API key is not valid",
"status": 401,
"code": "invalid_api_key",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/mandate_required",
"title": "No mandate with the needed power",
"status": 403,
"code": "mandate_required",
"detail": "Your mandate for tal_9t0wxyhk5zba2q8v1m3n7p4r6s does not include review_outputs.",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/resource_not_found",
"title": "No such object",
"status": 404,
"code": "resource_not_found",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/idempotency_key_in_use",
"title": "A request with this key is still running",
"status": 409,
"code": "idempotency_key_in_use",
"detail": "Retry with the same key after a short wait.",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/idempotency_key_reused",
"title": "This key was used for a different request",
"status": 422,
"code": "idempotency_key_reused",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/rate_limited",
"title": "Too many requests",
"status": 429,
"code": "rate_limited",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}Create a revocation
Planned contract — unavailable in test and live modes. This operation is a protocol reference, not a callable endpoint. Start with the working sandbox quickstart.
Revokes one license of a talent you represent. Needs a mandate with revoke for the
talent. It takes effect when this call returns: new checks deny, pending and held work
under the license is void, live sessions end within seconds, and every platform that used
it must act by acknowledge_by, 24 hours later. A revocation cannot be undone; to pause a
license instead, suspend it.
Set for_cause only for a breach, with the cause the platforms will read. Only a
revocation for cause applies a license’s withdraw policy to released outputs, which
platforms must take down and acknowledge by post_revocation.withdraw_by.
Only the talent withdraws a facet, withdraws consent everywhere or ends a mandate, in the
Talent Portal. Those revocations reach you in the feed and as revocation.created.
Restricted keys need revocations:write.
# Set a unique key once per new action; persist it and reuse it for every retry.
: "${REFLECTIONS_KEY:?Set REFLECTIONS_KEY before running this example}"
: "${REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY:?Set REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY before running this example}"
curl --fail-with-body --max-time 30 -X POST 'https://app.reflections.ai/v1/revocations' \
-H "Authorization: Bearer $REFLECTIONS_KEY" \
-H "Reflections-Version: 2026-10-15" \
-H "Idempotency-Key: $REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY" \
-H "Content-Type: application/json" \
--data-raw '{
"license": "lic_31x87g772xdcz1n1za29601rbt",
"note": "The campaign ended early."
}'import { env, exit } from "node:process";
// Set a unique key once per new action; persist it and reuse it for every retry.
const apiKey = env.REFLECTIONS_KEY;
if (!apiKey) throw new Error("Set REFLECTIONS_KEY before running this example");
const idempotencyKey = env.REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY;
if (!idempotencyKey) throw new Error("Set REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY before running this example");
const response = await fetch("https://app.reflections.ai/v1/revocations", {
method: "POST",
headers: {
Authorization: `Bearer ${apiKey}`,
"Reflections-Version": "2026-10-15",
"Idempotency-Key": idempotencyKey,
"Content-Type": "application/json",
},
body: JSON.stringify({
"license": "lic_31x87g772xdcz1n1za29601rbt",
"note": "The campaign ended early."
}),
signal: AbortSignal.timeout(30_000),
});
const responseBody = await response.text();
if (!response.ok) {
console.error(`HTTP ${response.status}: ${responseBody}`);
exit(1);
}
console.log(responseBody);
import json
import os
from urllib.error import HTTPError
from urllib.request import Request, urlopen
# Set a unique key once per new action; persist it and reuse it for every retry.
apiKey = os.environ["REFLECTIONS_KEY"]
if not apiKey:
raise ValueError("Set REFLECTIONS_KEY before running this example")
idempotencyKey = os.environ["REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY"]
if not idempotencyKey:
raise ValueError("Set REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY before running this example")
headers = {
"Authorization": f"Bearer {apiKey}",
"Reflections-Version": "2026-10-15",
"Idempotency-Key": idempotencyKey,
"Content-Type": "application/json",
}
data = json.dumps({"license": "lic_31x87g772xdcz1n1za29601rbt", "note": "The campaign ended early."}).encode("utf-8")
request = Request("https://app.reflections.ai/v1/revocations",
method="POST", headers=headers, data=data)
try:
with urlopen(request, timeout=30) as response:
print(response.read().decode("utf-8"))
except HTTPError as error:
error_body = error.read().decode("utf-8")
raise RuntimeError(f"HTTP {error.code}: {error_body}") from error
package main
import (
"fmt"
"io"
"net/http"
"os"
"strings"
"time"
)
func main() {
// Set a unique key once per new action; persist it and reuse it for every retry.
apiKey := os.Getenv("REFLECTIONS_KEY")
if apiKey == "" {
panic("Set REFLECTIONS_KEY before running this example")
}
idempotencyKey := os.Getenv("REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY")
if idempotencyKey == "" {
panic("Set REFLECTIONS_CREATE_REVOCATION_IDEMPOTENCY_KEY before running this example")
}
body := strings.NewReader(`{
"license": "lic_31x87g772xdcz1n1za29601rbt",
"note": "The campaign ended early."
}`)
request, err := http.NewRequest("POST", "https://app.reflections.ai/v1/revocations", body)
if err != nil {
panic(err)
}
request.Header.Set("Authorization", "Bearer " + apiKey)
request.Header.Set("Reflections-Version", "2026-10-15")
request.Header.Set("Idempotency-Key", idempotencyKey)
request.Header.Set("Content-Type", "application/json")
client := &http.Client{Timeout: 30 * time.Second}
response, err := client.Do(request)
if err != nil {
panic(err)
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
panic(err)
}
if response.StatusCode < 200 || response.StatusCode >= 300 {
panic(fmt.Sprintf("HTTP %d: %s", response.StatusCode, responseBody))
}
fmt.Print(string(responseBody))
}
{
"id": "rvk_1dxf6bkeqxsyw32j28wymgav5q",
"object": "revocation",
"livemode": false,
"scope": "license",
"targets": {
"talent": "tal_4n6p8r0t2v4x6z8b0d2f4h6j8k",
"licenses": [
"lic_31x87g772xdcz1n1za29601rbt"
],
"facets": [],
"mandate": null
},
"status": "pending_acknowledgement",
"initiated_by": "representative",
"for_cause": false,
"cause": null,
"note": "The campaign ended early.",
"effective_at": "2026-10-17T19:12:05Z",
"post_revocation": {
"policy": "retain",
"withdraw_by": null
},
"required_actions": [
"stop_generation",
"purge_cached_decisions"
],
"provider_copies": [],
"affected": {
"checks_denied": 0,
"generations_denied": 2,
"sessions_terminated": 0,
"released_outputs": 5
},
"acknowledge_by": "2026-10-18T19:12:05Z",
"acknowledgements": [],
"created_at": "2026-10-17T19:12:05Z"
}{
"type": "https://docs.reflections.ai/errors/parameter_invalid",
"title": "A parameter is invalid",
"status": 400,
"code": "parameter_invalid",
"param": "use.territories[1]",
"detail": "\"UK\" is not an ISO 3166-1 alpha-2 code. Use \"GB\".",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/invalid_api_key",
"title": "The API key is not valid",
"status": 401,
"code": "invalid_api_key",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/mandate_required",
"title": "No mandate with the needed power",
"status": 403,
"code": "mandate_required",
"detail": "Your mandate for tal_9t0wxyhk5zba2q8v1m3n7p4r6s does not include review_outputs.",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/resource_not_found",
"title": "No such object",
"status": 404,
"code": "resource_not_found",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/idempotency_key_in_use",
"title": "A request with this key is still running",
"status": 409,
"code": "idempotency_key_in_use",
"detail": "Retry with the same key after a short wait.",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/idempotency_key_reused",
"title": "This key was used for a different request",
"status": 422,
"code": "idempotency_key_reused",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "https://docs.reflections.ai/errors/rate_limited",
"title": "Too many requests",
"status": 429,
"code": "rate_limited",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}Authorizations
Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it
on your server. Restricted keys carry only the scopes you give them.
Headers
The dated API version. Defaults to the version your account is pinned to.
"2026-10-15"
A unique key for this operation, up to 255 characters. In test mode, POST keys are scoped to your account and mode and bind the endpoint and body for 24 hours. A different endpoint or body with the same key is refused.
Initial live check and generation creation require a nonempty key. Each operation has a
separate account-scoped namespace; retain the same API key, body and idempotency key for
retries within 24 hours of creation. A pending check returns 202 with status: "checking".
Completed checks replay their sealed response; successful generation POSTs replay the
original accepted 202, so use GET for current state. Live verification is a read-only
query that returns a fresh verification ID on each call, without exact response caching.
The broader delegated-account contract also scopes keys to Reflections-Account;
delegated requests and the other planned live POST operations remain unsupported.
255Body
The license to revoke. The revocation has scope license and names the license's talent in targets.talent.
^lic_[0-9a-hjkmnp-tv-z]{26}$Revoked for a breach. Only then does a license's withdraw policy apply.
Required when for_cause is true. Shown to the licensee and to every platform that must act, as the revocation's cause.
1000Shown to the licensee and platforms as the revocation's note.
1000Response
The revocation, in effect.
The revocation's ID. Pass it as after to read the revocations created after it.
^rvk_[0-9a-hjkmnp-tv-z]{26}$Always revocation.
"revocation"true in live mode, false for an object created with a test key.
license: one license. facet: a facet withdrawn, which narrows every license that covers it. mandate: a representative's authority ended. talent: consent withdrawn everywhere.
license, facet, mandate, talent What the revocation cuts. Which fields are set depends on scope.
Show child attributes
Show child attributes
pending_acknowledgement until every required action is acknowledged, then
acknowledged, or overdue if a deadline passes first.
pending_acknowledgement, acknowledged, overdue Who revoked: the talent in the Talent Portal, a representative whose mandate has
revoke, or Reflections.
talent, representative, reflections When the revocation took effect. acknowledge_by is 24 hours later.
What every platform that used the targets must do and acknowledge.
stop_generation: issue nothing new under the targets. purge_cached_decisions: drop
cached checks and authorizations. delete_provider_copies: delete copies held at model
providers, such as voices. cease_distribution: place released outputs nowhere new.
withdraw_outputs: take released outputs down.
stop_generation, purge_cached_decisions, delete_provider_copies, cease_distribution, withdraw_outputs When every required action except withdraw_outputs must be acknowledged: 24 hours
after effective_at.
Each acknowledgement a platform sent, in the order received. Shown on the talent's record.
Show child attributes
Show child attributes
When Reflections recorded the revocation.
Revoked for a breach. Only then can withdraw apply.
For a revocation for cause, the breach, as whoever revoked it stated it.
A note from whoever revoked it.
What happens to outputs released before effective_at, copied from the license's
post_revocation term.
Show child attributes
Show child attributes
Copies at model providers you must delete.
Show child attributes
Show child attributes
What the revocation cut, at effective_at.
Show child attributes
Show child attributes