Likeness rights API: check rights before generation over REST and MCP

A service that generates a person’s face, voice or persona needs a way to know whether that person allowed it. Rightis publishes each registered person’s permitted scope as allowed, approval required or denied, and treats unregistered people as not cleared. Getting that answer before generation leaves a record of every allowed and blocked generation.

Integrated services never receive face or voice files, only registration status, permitted scope, policy and a permission answer. There is no personal data to hold.

Call GET /api/public/v1/rights/lookup?rights_id=BR-XXXX-XXXX-XXXX. No key, CORS open. A registered person returns name, permitted scope, training consent and profile URL as JSON. An unregistered one returns registered: false with a message to treat the identity as not cleared for AI use.

The lookup returns only what the holder chose to publish and is rate limited. Bulk lookups and contracts move to the keyed API.

Connect the public MCP server at /api/public-mcp/mcp and the rights_lookup tool returns the same information as the public lookup. Being keyless, it fits as a default pre-generation step for any agent.

Work that needs a contract, such as license issuance, usage logging and persona policy lookup, goes through the partner-keyed MCP server and REST API. A sandbox key is available immediately in the developer console.

The full spec is at /api/v1/openapi.json. Creating an app in the developer console issues a sandbox key for license requests, usage logging and persona policy lookup. Policy and contract changes arrive as webhooks.

Persona policy applies per line. A character without a policy must be blocked outside its permitted assets; with a policy, tone, forms of address, banned topics and safety lines follow it.

Allowed and blocked generations are both logged as usage. When a license becomes active a proof is issued, settlement is scheduled and events go to both the holder and the partner. Partners receive settlement events on their app’s organization.

Machine-readable signals are published too: llms.txt, ai.txt, the W3C TDM reservation file, the registry file and the do-not-train list under rightis.org’s .well-known path and root.