> ## Documentation Index > Fetch the complete documentation index at: https://docs.reflections.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > The OpenAPI document at /api-reference/openapi.yaml defines the target contract. Its x-reflections-availability field and each operation's availability notice identify supported test and live forms. Do not infer implementation from a schema or code sample. Live keys support account details, reads of the licenses the calling account holds as licensee or issued as talent (GET /v1/licenses?role=issuer), and GET /v1/generations?license=… for the state of outputs under such a license (summaries only: no prompt, reference, bytes or metadata). Live image checks, submissions and receipts are built but not activated: until activation, a live POST /v1/checks or /v1/generations returns 403 live_not_activated, which must not be retried. Discovery and JWKS are at the origin root (https://app.reflections.ai/.well-known/...), not under /v1. > Three rules hold everywhere: a decision is never an error (deny and escalate are 200 responses, and a live check still evaluating is a 202 with status checking); generate nothing for a named talent without an allow; deliver nothing until the generation is allow. > The sandbox accepts personal rk_test_ keys. Persist a separate Idempotency-Key and body for each logical /v1 POST; retry an unknown outcome with the same key and body. OAuth and Talent API MCP remain planned. # Discovery > The discovery document every license server publishes, the talent index, and how a platform finds the license server for a talent. This page specifies the discovery document at `/.well-known/talent-license`, the signed talent index, and the order in which a platform finds the license server that decides for a talent. ## Discovery document **TLP-DSC-1.** A license server MUST serve its discovery document at its issuer followed by `/.well-known/talent-license` (a well-known URI, RFC 8615), over HTTPS, as `application/json`, without authentication and with a `Cache-Control` max-age. **TLP-DSC-2.** The document's `issuer` MUST equal the origin it is served from, and MUST equal the `iss` of every token and receipt the license server signs. | Field | Type | Meaning | | - | - | - | | `issuer` | string | The license server's issuer | | `protocol` | string | `"tlp"` | | `protocol_versions` | array | TLP versions served, such as `["1.0"]` | | `api_base` | string | The base URL of the license server's API | | `api_versions` | array | The license server's own API versions | | `jwks_uri` | string | The JWK Set of signing keys | | `check_endpoint` | string | Create a check | | `generation_endpoint` | string | Create a generation | | `session_endpoint` | string | Create a session | | `verification_endpoint` | string | Verify a file, manifest, digest, fingerprint or receipt | | `receipt_endpoint` | string | A URL template with `{receipt_id}`: a receipt and its live status | | `revocation_feed` | string | The revocation feed | | `talent_index` | string | The signed talent index | | `authorization_endpoint` | string | The OAuth 2.0 authorization endpoint | | `token_endpoint` | string | The OAuth 2.0 token endpoint, which also issues RSL license tokens | | `introspection_endpoint` | string | Introspection of RSL license tokens ([RSL](/standard/interop/rsl)) | | `mcp_endpoint` | string | The license server's MCP server, when it has one | | `receipt_page` | string | A URL template with `{receipt_id}`: the public receipt page | | `token_types` | array | The `typ` values it signs | | `obligation_types` | array | The obligation types it can return | | `c2pa_assertion_label` | string | The label of its C2PA assertion | **TLP-DSC-3.** A discovery document MUST contain `issuer`, `protocol`, `protocol_versions`, `jwks_uri`, `check_endpoint`, `generation_endpoint`, `receipt_endpoint`, `verification_endpoint`, `revocation_feed`, `receipt_page`, `token_types`, `obligation_types` and `c2pa_assertion_label`. The other fields are REQUIRED when the license server offers the feature. **TLP-DSC-4.** A client MUST ignore fields it does not recognize, and MUST NOT use a license server whose `protocol_versions` contains no version it implements. ### Example (informative) The Talent API's discovery document: ```json theme={null} { "issuer": "https://app.reflections.ai", "protocol": "tlp", "protocol_versions": ["1.0"], "api_base": "https://app.reflections.ai/v1", "api_versions": ["2026-10-15"], "jwks_uri": "https://app.reflections.ai/.well-known/jwks.json", "check_endpoint": "https://app.reflections.ai/v1/checks", "generation_endpoint": "https://app.reflections.ai/v1/generations", "session_endpoint": "https://app.reflections.ai/v1/sessions", "verification_endpoint": "https://app.reflections.ai/v1/verifications", "receipt_endpoint": "https://app.reflections.ai/v1/receipts/{receipt_id}", "revocation_feed": "https://app.reflections.ai/v1/revocations", "talent_index": "https://app.reflections.ai/v1/talent/index", "authorization_endpoint": "https://app.reflections.ai/oauth/authorize", "token_endpoint": "https://app.reflections.ai/oauth/token", "introspection_endpoint": "https://app.reflections.ai/oauth/introspect", "mcp_endpoint": "https://app.reflections.ai/mcp", "receipt_page": "https://app.reflections.ai/r/{receipt_id}", "token_types": ["tlp-auth+jwt", "tlp-session+jwt", "tlp-receipt+jwt"], "obligation_types": [ "generation_check", "hold_until_release", "draft_watermark", "generation_instructions", "disclosure", "attribution", "c2pa_manifest", "no_training", "delete_material", "usage_report" ], "c2pa_assertion_label": "ai.reflections.license" } ``` ## Finding the license server for a talent **TLP-DSC-5.** A platform MUST find the license server that decides for a talent in this order, and MUST use the first one found: 1. A license server named explicitly for the talent: the server a Human Consent Standard declaration names, or the `server` attribute of an RSL license that covers the talent. 2. The talent index of a license server the platform already uses, when the talent is listed in it. 3. The discovery document at `/.well-known/talent-license` of another license server the platform knows, whose talent index lists the talent. **TLP-DSC-6.** A platform MUST NOT continue down the order to find a license server with a more permissive answer. A license server found by this order decides for the talent, including when its answer is `deny`. **TLP-DSC-7.** Before it sends a check to a license server it found through a declaration, an RSL document or a discovery document, a platform MUST fetch that server's discovery document and confirm that `protocol` is `"tlp"` and that `issuer` equals the origin it fetched. ## Talent index The talent index lists the names of every talent a license server protects, so a platform can match prompts on its own side. | Field | Meaning | | - | - | | `version` | The version of this index | | `generated_at` | When it was built | | `expires_at` | Do not match against it after this time | | `normalization` | `nfkc_casefold`: Unicode NFKC normalization followed by case folding | | `entries` | For each talent, `talent` (the `tal_` ID), `names` (normalized name, aliases and transliterations) and `common` (whether a match alone is weak evidence) | | `signature` | A detached JWS over the canonical `entries` | **TLP-DSC-8.** A license server MUST sign the talent index with a detached JWS (RFC 7515, Appendix F) whose payload is the `tlp-json-1` form of `entries`, using `ES256` and a key in its JWK Set, and MUST rebuild it at least hourly. **TLP-DSC-9.** A platform MUST verify the index signature before it uses an index, by rebuilding the payload as the `tlp-json-1` form of `entries`, and MUST NOT match against an index after its `expires_at`. It MUST normalize prompt text with NFKC and case folding before matching. **TLP-DSC-10.** A local match tells a platform to send a check. A platform MUST send a check for every request that names a talent in `talent`, matches its current talent index, or has a `reference` or `voice_sample` input. A platform with no current index MUST send a check for every request. It SHOULD send one for every other request: indirect references, such as "the runner from Ridgeline's spring campaign", are resolved only by the license server. ## Related The Talent API's discovery document and JWKS. The talent index endpoint. The `server` attribute, and RSL license tokens. Declarations that name a license server. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.