Skip to main content
Production protocol reference. The current sandbox has deterministic test decisions. The name index, revocation feed, session stream and webhook delivery discussed below are not available. Start with the runnable quickstart and sandbox support matrix.
Two rules decide what your platform does when something fails:
  1. Fail closed for named talent. If a request invokes a talent and you cannot get an allow, do not generate, and do not deliver an output whose generation is not allow.
  2. Proceed only on requests that name and match no one. While Reflections cannot be reached, you may generate and deliver a request that names no talent in talent, matches no entry in your current name index, and carries no reference or voice sample.
An outage of Reflections therefore stops generation of named talent on your platform. That is a deliberate cost: the alternative would turn every outage into a window for unlicensed likeness, which the talent could neither see nor undo. The proposed production availability target for checks is 99.95% per month; it is not a confirmed service commitment or measured sandbox result. See status.reflections.ai for reported service status.

At a glance

Retries

Retry an unknown outcome, such as a timeout, with the same Idempotency-Key, never a new one. Keys are kept 24 hours: the same key and body return the original response, so a check that was decided before the connection dropped is not decided twice. A 409 idempotency_key_in_use means the first request is still running; wait briefly and retry with the same key.

Outputs during an outage

An output of a named talent is not delivered until its generation is allow. Keep it, and submit it with the same Idempotency-Key when Reflections returns. If the generation is then refused with 409 check_expired, run a new check before you generate again. A request that names no talent, matches no entry in your name index, and carries no reference or voice sample may be generated and delivered while Reflections is unreachable. Match only against an index whose expires_at has not passed: with no current index, every request waits. An indirect reference, such as “the runner from Ridgeline’s spring campaign”, is resolved only by a check, so during an outage it goes unresolved.

Evaluator outages

Sometimes Reflections is reachable but cannot finish a check, for example when an evaluator times out or returns something it cannot read.
  • At the check, the decision is escalate with escalation.reason: "evaluation_unavailable". A person decides, and you receive check.resolved. With on_escalate: "deny", you get deny with review_required instead.
  • At the generation, a rule the talent wrote that could not be read is delivered and recorded as unchecked: its finding has result: "unchecked" and its address is in unchecked_terms. A protected attribute, such as identity.samePerson, that could not be confirmed denies the output.

Reuse windows

A check with reuse: { "max_generations": 200, "ttl": "PT15M" } lets one decision cover many generations of the same use for the same end user, up to 1,000 generations and 15 minutes. While it lasts, those generations need no new check, including during a short outage. A revocation ends it at once.

Sessions

A session token lives 5 minutes and is renewed every 60 seconds.
  • If a renewal fails with 409 session_not_active, the license was revoked, suspended or ended, or the session was terminated. Stop output at once.
  • If a renewal cannot reach Reflections, continue until the current token’s expires_at, never past it, and keep retrying.
  • If the session stream drops, reconnect and read the session to learn its state. A missed session.terminated is also reflected on the session and sent as a webhook.

Caching and the revocation feed

If you keep decisions to act on later, such as authorizations, reuse windows or session tokens, read the revocation feed, GET /v1/revocations?after=rvk_…, at least every 60 seconds. Webhooks are the fast path; the feed is the source of truth, and it returns everything after the last revocation you processed. Webhook deliveries are retried for 72 hours, and events are kept 30 days, so an endpoint that was down can catch up from GET /v1/events.

Testing failure paths

In test mode, put rfl_test_unavailable in a check’s text to get escalate with evaluation_unavailable, rfl_test_unchecked in a generation’s transcript to get allow with a rule in unchecked_terms. See Sandbox.

Caching and outages

Reuse windows, the revocation feed and retries.

Idempotency

Keys, replay and the three outcomes.

Revocation

What a revocation stops, and how fast.

Monitoring

Request IDs, the status page and alerts.