Content Rights

When you sign a file with Sign It, you can attach a Content Rights manifest - a machine-readable declaration of your terms, backed by your cryptographic signature. You approve it in your own Vault; no one in between can alter it.

Why It Matters

There's no standardized way for creators to declare terms for commercial use and AI training that is:

Verifiable - cryptographically signed, can't be forged
Discoverable - on Flowsta's tamper-proof network, built on Holochain, not buried in metadata
Machine-readable - AI crawlers and pipelines can check programmatically
Persistent - not dependent on a single server

Sign It addresses this gap. Your rights declaration is attached to cryptographic proof of authorship.

Fields

All fields are optional. You control what to include at signing time.

Each table shows the label the Vault offers, the value an app sends through the SDKs or the REST API, and the enum form the network stores and every verification response returns.

License

Vault label	Value you send	On the network	Meaning
Copyright protected	`all-rights-reserved`	`AllRightsReserved`	No permissions granted
Public domain (CC0)	`cc0`	`CC0`	Public domain dedication
Free to share with credit (CC BY)	`cc-by`	`CCBY`	Attribution required
Free to share with credit, same license (CC BY-SA)	`cc-by-sa`	`CCBYSA`	Attribution + ShareAlike
Free for non-commercial use with credit (CC BY-NC)	`cc-by-nc`	`CCBYNC`	Attribution + NonCommercial
Non-commercial, credit, same license (CC BY-NC-SA)	`cc-by-nc-sa`	`CCBYNCSA`	Attribution + NonCommercial + ShareAlike
MIT License	`mit`	`MIT`	MIT License
Apache 2.0 License	`apache-2`	`Apache2`	Apache License 2.0
GPL 3.0 License	`gpl-3`	`GPL3`	GNU GPL v3

The network also stores a custom license as { "Custom": "<text>" }, up to 128 characters. The Vault does not offer it, and neither SDK maps to it; you may meet it in records made by other apps, so treat license as string | { Custom: string } when you read responses.

Commercial Licensing

Vault label	Value you send	On the network	Meaning
Not available for licensing	`not_available`	`NotAvailable`	Not open to commercial licensing
Open to licensing enquiries	`open_to_licensing`	`OpenToLicensing`	Contact me to discuss licensing (via Flowsta relay)

AI Training Policy

Vault label	Value you send	On the network	Meaning
Anyone can use this to train AI	`allowed`	`Allowed`	Free to include in AI training data
Can train AI if they credit me	`allowed_with_attribution`	`AllowedWithAttribution`	May train on, but credit the creator
Get permission before training AI	`requires_license`	`RequiresLicense`	Must obtain a license before training
Do not use to train AI	`not_allowed`	`NotAllowed`	Do not include in AI training data

Contact Preference

Vault label	Value you send	On the network	Meaning
Do not contact me	`no_contact`	`NoContact`	Do not contact me about this file
Allow contact requests	`allow_contact_requests`	`AllowContactRequests`	I'm open to messages via Flowsta's blind relay

Contact Relay

When a signer sets "Allow contact requests", the verification page shows a Contact signer about licensing button under that signature. The requester fills in their name, email, purpose, and a message in the Contact Signer form. Flowsta relays this as an email to the signer.

Privacy guarantees:

The signer's email is never exposed to the requester
The API returns the same response whether the signer exists or not (prevents enumeration)
Rate limited: 3 messages per hour per IP
The signer decides whether to reply

What It Does NOT Do

It's not DRM - it doesn't prevent copying or training
It's not legally binding by itself - but a signed, timestamped, publicly verifiable declaration is strong evidence in disputes
It doesn't enforce compliance - but it makes terms clear and discoverable

Example

A photographer signs a photo in their Vault with:

Intent:      Authorship
AI Content:  No AI
License:     CC BY-NC
Commercial:  Open to licensing enquiries
AI Training: Get permission before training AI
Contact:     Allow contact requests

This means: "I created this photo without AI. You can share it non-commercially with attribution. For commercial use or AI training, contact me to arrange a license."

Anyone verifying the file sees this declaration, backed by the photographer's cryptographic identity.

API Endpoint

For AI training pipelines, search engines, and content platforms that need to check rights programmatically, Sign It exposes a machine-readable endpoint.

Request

GET https://auth-api.flowsta.com/api/v1/sign-it/content-rights?hash=<sha256>

Parameters:

Name	Required	Description
`hash`	yes	64-character hex SHA-256 of the file you want to check. Anything else returns `400 invalid_hash`

Response

json

{
  "file_hash": "abc123...",
  "signed": true,
  "signer_count": 2,
  "content_rights": {
    "ai_training": "NotAllowed",
    "licenses": ["CCBYNC"],
    "contact_available": true
  },
  "signers": [
    {
      "signer": "uhCAkynvT4p77x...",
      "signed_at": 1680000000000,
      "license": "CCBYNC",
      "ai_training": "NotAllowed",
      "commercial_licensing": "OpenToLicensing",
      "contact_preference": "AllowContactRequests"
    },
    {
      "signer": "uhCAkq83bT9mzz...",
      "signed_at": 1680000001000,
      "license": "CCBYNC",
      "ai_training": "RequiresLicense",
      "commercial_licensing": null,
      "contact_preference": null
    }
  ],
  "verify_url": "https://flowsta.com/sign-it/?hash=abc123..."
}

Notes on the shape:

content_rights is the aggregate across all active (non-revoked) signers. It's null if no active signature declared any rights.
content_rights.licenses is always an array of the distinct declared licenses, in the network's raw enum form (CCBYNC, AllRightsReserved, MIT, ...) - not prose like "CC BY-NC 4.0". One value when all signers agree; more when they don't. A custom license arrives as an object, { "Custom": "..." }.
content_rights.contact_available is true if any active signer allows contact requests.
signers lists each active signer's own declaration (values null where the signer didn't declare that field), so you can inspect disagreements yourself.

If the file has never been signed:

json

{
  "file_hash": "abc123...",
  "signed": false,
  "signer_count": 0,
  "content_rights": null,
  "signers": [],
  "verify_url": "https://flowsta.com/sign-it/?hash=abc123..."
}

Aggregation Rules

When multiple signers set different AI training policies, the most restrictive policy wins:

NotAllowed > RequiresLicense > AllowedWithAttribution > Allowed

Licenses are not ranked - licenses simply lists every distinct declared value. Revoked signatures are excluded from the aggregation entirely.

Rate Limit & Cache

60 requests/minute per IP. Responses include Cache-Control: public, max-age=300 (5 minutes) - safe for CDN edge caching, so pipelines checking millions of files won't flood the API.

For AI Training Pipelines

Before adding a file to a training corpus, check:

python

import hashlib, requests

def is_training_allowed(file_bytes: bytes) -> bool:
    h = hashlib.sha256(file_bytes).hexdigest()
    r = requests.get(
        "https://auth-api.flowsta.com/api/v1/sign-it/content-rights",
        params={"hash": h},
        timeout=5,
    )
    if r.status_code != 200 or not r.json().get("signed"):
        return True  # No signature, no explicit objection
    rights = r.json().get("content_rights") or {}
    policy = rights.get("ai_training")
    return policy in (None, "Allowed", "AllowedWithAttribution")

If the policy is RequiresLicense, use contact_available (and the verify_url) to reach the signer before proceeding.

Unsigned Files

The endpoint returns signed: false for any hash that has never been signed. Absence of a signature is not an objection - it just means the creator hasn't declared rights through Sign It. Pipelines should fall back to site-level signals (robots.txt, terms of service, licensing metadata).

Adopting the Standard

The Content Rights field set is open - there's no proprietary schema, no license to use, and no API key required to query. If you're building a content-rights system, we'd love the same enum values to become a de-facto standard so a single query surfaces rights regardless of which service signed the file.

Content Rights ​

Why It Matters ​

Fields ​

License ​

Commercial Licensing ​

AI Training Policy ​

Contact Preference ​

Contact Relay ​

What It Does NOT Do ​

Example ​

API Endpoint ​

Request ​

Response ​

Aggregation Rules ​

Rate Limit & Cache ​

For AI Training Pipelines ​

Unsigned Files ​

Adopting the Standard ​