Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it on your server. Restricted keys carry only the scopes you give them.

Headers

Reflections-Version
string

The dated API version. Defaults to the version your account is pinned to.

Example:

"2026-10-15"

Reflections-Account
string

Act for a connected licensee. The value is the licensee's account ID. Requires an active connection between that account and yours.

Pattern: ^acct_[0-9a-hjkmnp-tv-z]{26}$
Idempotency-Key
string

A unique key for this operation, up to 255 characters. In test mode, POST keys are scoped to your account and mode and bind the endpoint and body for 24 hours. A different endpoint or body with the same key is refused.

Initial live check and generation creation require a nonempty key. Each operation has a separate account-scoped namespace; retain the same API key, body and idempotency key for retries within 24 hours of creation. A pending check returns 202 with status: "checking". Completed checks replay their sealed response; successful generation POSTs replay the original accepted 202, so use GET for current state. Live verification is a read-only query that returns a fresh verification ID on each call, without exact response caching.

The broader delegated-account contract also scopes keys to Reflections-Account; delegated requests and the other planned live POST operations remain unsupported.

Maximum string length: 255

Path Parameters

session_id
string
required

The session's ID.

Pattern: ^ses_[0-9a-hjkmnp-tv-z]{26}$

Response

The renewed token.

token
string
required

The new session token, a JWS with typ tlp-session+jwt. Pass it to your voice provider if it verifies session tokens.

expires_at
string<date-time>
required

When the new token expires, 5 minutes after it was issued. Never continue output past it.