Content policy and safety

VelvetAPI generates adult content featuring fictional adults for adult platforms, and it’s strict about the content that’s never allowed. This page explains the checks every request goes through. The Acceptable Use Policy is the binding version of the rules.

Adults only

• You must be 18 or older, and old enough to view adult content where you live. The console asks you to confirm your age before it shows any generated image.
• If your users generate images, you must age-check them to the standard your audience’s laws require. A self-declared age isn’t enough in some places, including the UK and many US states.

Never allowed

• Any sexual or sexualized depiction of someone who is, or appears to be, under 18, in any style. That includes youth-coded content such as “teen” references or school settings in a sexual context.
• Intimate or sexual images of a real, identifiable person without their documented consent, including face swaps and look-alikes.
• Non-consensual or violent sexual content, and the other categories listed in the Acceptable Use Policy.

How requests are checked

Prompt screening

Every prompt is screened before a task is queued:

1. Youth-coded wording. Prompts that reference minors or youth, such as “teen” or a stated age under 18, are refused with 422 prompt_blocked and the category youth_coded. This doesn’t count as a strike, so rephrase and try again.
2. Semantic screening. A safety classifier then reads the whole prompt. Prompts it identifies as child sexual exploitation are refused with 422 prompt_blocked, and each refusal is a strike against the end user who sent it.

If screening can’t run, the task isn’t created and you get 503 screening_unavailable: we would rather fail a request than run it unchecked. Nothing is held, so retry after a short wait. An account with more than 60 refused prompts in a minute gets 429 too_many_declined_prompts until the rate drops.

End users and strikes

Every task must say which of your end users asked for it, in user: your own id for that person, up to 128 characters. Use a stable id that doesn’t reveal who they are, such as your database id or a hash of it. Never send one shared id for everyone, or one user’s strikes will suspend them all.

Strikes are counted per end user. When an end user reaches 10 strikes, they’re suspended and further tasks for them fail with 403 end_user_suspended. Your other users aren’t affected. Images withheld by the output check (below) count as strikes too.

Refusals that add a strike tell you where the end user stands, so you can act on repeat offenders in your own app:

{
  "error": {
    "type": "prompt_blocked",
    "message": "The prompt was refused by content screening.",
    "categories": ["S4"],
    "end_user_strikes": 3,
    "end_user_suspended": false
  }
}

Output checks

Images from the models that run on our own GPUs are checked before anything is stored or returned. If an image contains adult content and a person in it appears to be under 18, no image is delivered: the task fails with meta.withheld: true, you aren’t charged, and the end user gets a strike. Withheld images are kept only in locked evidence storage for review.

The check is deliberately cautious, so a youthful-looking adult is occasionally withheld. Describing subjects clearly as adults in the prompt helps.

Models resold from other publishers (marked “Publisher’s API” on the models list) run on the publisher’s own service instead. Prompt screening still applies, and the publisher’s moderation refuses adult content.

Reference images

For edits, reference_images must be output URLs that your account generated and that haven’t been taken down. Uploaded photos aren’t accepted, which keeps photos of real people out of edits. Any other URL fails the request with 422 reference_not_allowed, listing the refused URLs in rejected. Outputs are deleted after 14 days, so references must be recent.

Reports

Anyone can report an image at velvetapi.dev/report without an account. Platforms can also file reports from code with POST /v1/reports, which needs no key:

curl https://api.velvetapi.dev/v1/reports \
  -H "Content-Type: application/json" \
  -d '{
    "output_url": "https://cdn.velvetapi.dev/o/…/0.jpg",
    "category": "ncii",
    "details": "Reported by the person shown in the image."
  }'

{ "reference": "R-7KQ2XM", "status": "open", "due_at": "2026-10-22T06:31:00.000Z" }

• Give the image’s output_url or the task_id that created it.
• category is ncii (non-consensual intimate imagery, including AI-generated), csam (suspected child sexual abuse material) or other. email and details are optional.
• ncii and csam reports take the image offline immediately. It’s restored only if the review finds the report unfounded.
• Every report is reviewed within 48 hours, by due_at.
• Suspected child sexual abuse material is reported to the National Center for Missing & Exploited Children (NCMEC), and the account behind it is suspended.

What you’re responsible for

• Age-check your users, and send a real per-user user id with every task.
• Show people a clear message when a prompt is refused, and don’t retry refused prompts.
• Act on reports and abuse from your own users, and report images to us when you learn of a problem.
• Follow the Acceptable Use Policy and the laws that apply to you, your users and your viewers.