Discovery

This page specifies the discovery document at /.well-known/talent-license, the signed talent index, and the order in which a platform finds the license server that decides for a talent.

Discovery document

TLP-DSC-1. A license server MUST serve its discovery document at its issuer followed by /.well-known/talent-license (a well-known URI, RFC 8615), over HTTPS, as application/json, without authentication and with a Cache-Control max-age. TLP-DSC-2. The document’s issuer MUST equal the origin it is served from, and MUST equal the iss of every token and receipt the license server signs.

Field	Type	Meaning
`issuer`	string	The license server’s issuer
`protocol`	string	`"tlp"`
`protocol_versions`	array	TLP versions served, such as `["1.0"]`
`api_base`	string	The base URL of the license server’s API
`api_versions`	array	The license server’s own API versions
`jwks_uri`	string	The JWK Set of signing keys
`check_endpoint`	string	Create a check
`generation_endpoint`	string	Create a generation
`session_endpoint`	string	Create a session
`verification_endpoint`	string	Verify a file, manifest, digest, fingerprint or receipt
`receipt_endpoint`	string	A URL template with `{receipt_id}`: a receipt and its live status
`revocation_feed`	string	The revocation feed
`talent_index`	string	The signed talent index
`authorization_endpoint`	string	The OAuth 2.0 authorization endpoint
`token_endpoint`	string	The OAuth 2.0 token endpoint, which also issues RSL license tokens
`introspection_endpoint`	string	Introspection of RSL license tokens (RSL)
`mcp_endpoint`	string	The license server’s MCP server, when it has one
`receipt_page`	string	A URL template with `{receipt_id}`: the public receipt page
`token_types`	array	The `typ` values it signs
`obligation_types`	array	The obligation types it can return
`c2pa_assertion_label`	string	The label of its C2PA assertion

TLP-DSC-3. A discovery document MUST contain issuer, protocol, protocol_versions, jwks_uri, check_endpoint, generation_endpoint, receipt_endpoint, verification_endpoint, revocation_feed, receipt_page, token_types, obligation_types and c2pa_assertion_label. The other fields are REQUIRED when the license server offers the feature. TLP-DSC-4. A client MUST ignore fields it does not recognize, and MUST NOT use a license server whose protocol_versions contains no version it implements.

Example (informative)

The Talent API’s discovery document:

{
  "issuer": "https://app.reflections.ai",
  "protocol": "tlp",
  "protocol_versions": ["1.0"],
  "api_base": "https://app.reflections.ai/v1",
  "api_versions": ["2026-10-15"],
  "jwks_uri": "https://app.reflections.ai/.well-known/jwks.json",
  "check_endpoint": "https://app.reflections.ai/v1/checks",
  "generation_endpoint": "https://app.reflections.ai/v1/generations",
  "session_endpoint": "https://app.reflections.ai/v1/sessions",
  "verification_endpoint": "https://app.reflections.ai/v1/verifications",
  "receipt_endpoint": "https://app.reflections.ai/v1/receipts/{receipt_id}",
  "revocation_feed": "https://app.reflections.ai/v1/revocations",
  "talent_index": "https://app.reflections.ai/v1/talent/index",
  "authorization_endpoint": "https://app.reflections.ai/oauth/authorize",
  "token_endpoint": "https://app.reflections.ai/oauth/token",
  "introspection_endpoint": "https://app.reflections.ai/oauth/introspect",
  "mcp_endpoint": "https://app.reflections.ai/mcp",
  "receipt_page": "https://app.reflections.ai/r/{receipt_id}",
  "token_types": ["tlp-auth+jwt", "tlp-session+jwt", "tlp-receipt+jwt"],
  "obligation_types": [
    "generation_check", "hold_until_release", "draft_watermark", "generation_instructions",
    "disclosure", "attribution", "c2pa_manifest", "no_training", "delete_material", "usage_report"
  ],
  "c2pa_assertion_label": "ai.reflections.license"
}

Finding the license server for a talent

TLP-DSC-5. A platform MUST find the license server that decides for a talent in this order, and MUST use the first one found:

A license server named explicitly for the talent: the server a Human Consent Standard declaration names, or the server attribute of an RSL license that covers the talent.
The talent index of a license server the platform already uses, when the talent is listed in it.
The discovery document at /.well-known/talent-license of another license server the platform knows, whose talent index lists the talent.

TLP-DSC-6. A platform MUST NOT continue down the order to find a license server with a more permissive answer. A license server found by this order decides for the talent, including when its answer is deny. TLP-DSC-7. Before it sends a check to a license server it found through a declaration, an RSL document or a discovery document, a platform MUST fetch that server’s discovery document and confirm that protocol is "tlp" and that issuer equals the origin it fetched.

Talent index

The talent index lists the names of every talent a license server protects, so a platform can match prompts on its own side.

Field	Meaning
`version`	The version of this index
`generated_at`	When it was built
`expires_at`	Do not match against it after this time
`normalization`	`nfkc_casefold`: Unicode NFKC normalization followed by case folding
`entries`	For each talent, `talent` (the `tal_` ID), `names` (normalized name, aliases and transliterations) and `common` (whether a match alone is weak evidence)
`signature`	A detached JWS over the canonical `entries`

TLP-DSC-8. A license server MUST sign the talent index with a detached JWS (RFC 7515, Appendix F) whose payload is the tlp-json-1 form of entries, using ES256 and a key in its JWK Set, and MUST rebuild it at least hourly. TLP-DSC-9. A platform MUST verify the index signature before it uses an index, by rebuilding the payload as the tlp-json-1 form of entries, and MUST NOT match against an index after its expires_at. It MUST normalize prompt text with NFKC and case folding before matching. TLP-DSC-10. A local match tells a platform to send a check. A platform MUST send a check for every request that names a talent in talent, matches its current talent index, or has a reference or voice_sample input. A platform with no current index MUST send a check for every request. It SHOULD send one for every other request: indirect references, such as “the runner from Ridgeline’s spring campaign”, are resolved only by the license server.

Discovery format

The Talent API’s discovery document and JWKS.

Download the name index

The talent index endpoint.

RSL 1.0

The server attribute, and RSL license tokens.

Human Consent Standard

Declarations that name a license server.

Talent License Protocol

Interoperability

Discovery document

Example (informative)

Finding the license server for a talent

Talent index

Discovery format

Download the name index

RSL 1.0

Human Consent Standard

​Discovery document

​Example (informative)

​Finding the license server for a talent

​Talent index

​Related

Discovery format

Download the name index

RSL 1.0

Human Consent Standard

Discovery document

Example (informative)

Finding the license server for a talent

Talent index

Related