creators
Creator identities attributed in content credentials, their disclosure policy, and authorized disclosure.
| Method | Path | Operation ID |
|---|---|---|
| GET | /v1/creator-disclosure-policy |
getCreatorDisclosurePolicy |
| PUT | /v1/creator-disclosure-policy |
updateCreatorDisclosurePolicy |
| GET | /v1/creator-identities |
listCreatorIdentities |
| POST | /v1/creator-identities |
createCreatorIdentity |
| GET | /v1/creator-identities/{creator_identity_id} |
getCreatorIdentity |
| GET | /v1/creator-identities/{creator_identity_id}/disclosure |
discloseCreatorIdentity |
| POST | /v1/creator-identities/{creator_identity_id}/withdraw |
withdrawCreatorIdentity |
GET /v1/creator-disclosure-policy
Section titled “GET /v1/creator-disclosure-policy”Operation ID: getCreatorDisclosurePolicy
Read this tenant’s creator disclosure policy.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json CreatorDisclosurePolicyResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
brand_name |
string | yes | |
console_disclosure |
enum | yes | One of: none, attributed, name, name_and_email. |
notice_version |
string or null | no | |
share_disclosure |
enum | yes | One of: none, attributed, name. |
PUT /v1/creator-disclosure-policy
Section titled “PUT /v1/creator-disclosure-policy”Operation ID: updateCreatorDisclosurePolicy
Set this tenant’s brand name and creator disclosure policy.
The tenant is the controller here, so this decision is theirs, not ours.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Request body
Section titled “Request body”application/json: CreatorDisclosurePolicyRequest (required)
| Field | Type | Required | Description |
|---|---|---|---|
brand_name |
string | yes | Max length 200. |
console_disclosure |
enum | no | One of: none, attributed, name, name_and_email. Default "name_and_email". |
notice_version |
string or null | no | |
share_disclosure |
enum | no | One of: none, attributed, name. Default "name". |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json CreatorDisclosurePolicyResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. This operation may also return its reason-coded domain envelope with this status. |
application/json HttpErrorResponse or ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
brand_name |
string | yes | |
console_disclosure |
enum | yes | One of: none, attributed, name, name_and_email. |
notice_version |
string or null | no | |
share_disclosure |
enum | yes | One of: none, attributed, name. |
GET /v1/creator-identities
Section titled “GET /v1/creator-identities”Operation ID: listCreatorIdentities
List this tenant’s enrolled creator identities.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
state |
query | enum or null | no | |
cursor |
query | string or null | no | |
limit |
query | integer or null | no |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json CreatorIdentityListResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
items |
array of CreatorIdentityResponse | yes | |
next_cursor |
string or null | no |
POST /v1/creator-identities
Section titled “POST /v1/creator-identities”Operation ID: createCreatorIdentity
Enrol one creator identity for later attribution.
Enrol a creator, or return the existing active record for that subject. Re-enrolling the same person is a reuse rather than a conflict: the caller usually cannot know whether that subject was enrolled before, and a second row would split one person’s attribution history in two.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
Idempotency-Key |
header | string | yes | Pattern: ^[!-~]+$. Max length 200. |
Request body
Section titled “Request body”application/json: CreatorIdentityCreateRequest (required)
| Field | Type | Required | Description |
|---|---|---|---|
consent |
CreatorConsentRequest | yes | The tenant’s attestation that it holds a lawful basis. Original Pictures records this; it does not obtain the consent, and no surface may render it as though it had. |
email |
string | yes | Max length 320. |
name |
string or null | no |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 201 | Successful Response | application/json CreatorIdentityResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. This operation may also return its reason-coded domain envelope with this status. |
application/json HttpErrorResponse or ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
201 response fields
Section titled “201 response fields”| Field | Type | Required | Description |
|---|---|---|---|
assurance_level |
enum | yes | One of: self_asserted, verified. |
created_at |
string | yes | |
creator_id |
string | yes | Pattern: ^crid_[a-z2-7]{16}$. |
display_name_present |
boolean | yes | |
erased_at |
string or null | no | |
status |
enum | yes | One of: active, withdrawn, erased. |
withdrawn_at |
string or null | no |
GET /v1/creator-identities/{creator_identity_id}
Section titled “GET /v1/creator-identities/{creator_identity_id}”Operation ID: getCreatorIdentity
Read one enrolled creator identity.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
creator_identity_id |
path | string | yes | Pattern: ^crid_[a-z2-7]{16}$. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json CreatorIdentityResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
assurance_level |
enum | yes | One of: self_asserted, verified. |
created_at |
string | yes | |
creator_id |
string | yes | Pattern: ^crid_[a-z2-7]{16}$. |
display_name_present |
boolean | yes | |
erased_at |
string or null | no | |
status |
enum | yes | One of: active, withdrawn, erased. |
withdrawn_at |
string or null | no |
GET /v1/creator-identities/{creator_identity_id}/disclosure
Section titled “GET /v1/creator-identities/{creator_identity_id}/disclosure”Operation ID: discloseCreatorIdentity
Disclose one creator’s details to the owning tenant.
The only route that decrypts. Gated by its own creators:disclose scope.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
creator_identity_id |
path | string | yes | Pattern: ^crid_[a-z2-7]{16}$. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json CreatorDisclosureResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. This operation may also return its reason-coded domain envelope with this status. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
assurance_level |
enum | yes | One of: self_asserted, verified. |
assurance_statement |
string | yes | |
audience |
enum | yes | One of: operator, owning_tenant, public. |
commitment |
object or null | no | |
creator_ref |
string or null | no | |
disclosure_state |
enum | yes | One of: disclosed, withheld, withdrawn, erased, unavailable. |
end_user |
object or null | no | |
schema_version |
const “op.creator-disclosure.v1” | yes | |
tenant |
object | yes |
POST /v1/creator-identities/{creator_identity_id}/withdraw
Section titled “POST /v1/creator-identities/{creator_identity_id}/withdraw”Operation ID: withdrawCreatorIdentity
Stop disclosing one creator identity without erasing it.
Withdrawal is reversible bookkeeping; erasure runs through governance.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
creator_identity_id |
path | string | yes | Pattern: ^crid_[a-z2-7]{16}$. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json CreatorIdentityResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
assurance_level |
enum | yes | One of: self_asserted, verified. |
created_at |
string | yes | |
creator_id |
string | yes | Pattern: ^crid_[a-z2-7]{16}$. |
display_name_present |
boolean | yes | |
erased_at |
string or null | no | |
status |
enum | yes | One of: active, withdrawn, erased. |
withdrawn_at |
string or null | no |