The Problem Every Platform Developer Faces
If you build software for adult content — a creator platform, a clip site, a UGC marketplace — you know the compliance question comes up fast. Every performer who posts explicit content triggers 18 U.S.C. § 2257 obligations: government-issued ID on file, records cross-indexed to every piece of content, a Custodian of Records address on every page, 7-year retention enforced at the record level. That's before you get to Mastercard AN 5196, Visa VIRP, or the TAKE IT DOWN Act.
Building all of that yourself is a 6–12 month engineering project, plus ongoing maintenance, plus legal review. Most platforms either skip it (enormous liability) or bolt on a manual process that breaks under scale.
Today we're shipping a better option.
The Easy2257 Partner API
The Partner API lets your platform outsource the entire 2257 compliance stack to Easy2257 in a single integration. Here's the complete picture:
3 API calls + 1 redirect + 2 webhook handlers.
That's the surface area of a full compliance integration. Here's what each piece does:
Provisioning: POST /api/v1/solo-accounts
When a creator signs up on your platform, you call this endpoint with their email and your internal user ID. We create an Easy2257 account and return an accountId, an onboardingUrl, and status pending_id_verification. Store the accountId against your user record and redirect the creator to the URL. They scan their government ID, subscribe, and we send you a solo_account.verified webhook. At that point, the creator has an active Custodian of Records on file and you can enable uploads.
Idempotent — calling it twice with the same user ID returns the existing account. Safe to call on every login if you want to re-surface the onboarding URL for incomplete accounts.
Content Logging: POST /api/v1/solo-accounts/{id}/content
After a creator publishes explicit content, call this with the content URL, title, and media type. We create a cross-reference entry linking the content to the creator's identity record. This is the per-depiction audit trail required by 28 CFR 75.2 — the index the DOJ would pull in an inspection.
Include a SHA-256 hash of the file and we'll store that too (28 CFR 75.2(f) integrity requirement). Pass your internal content ID as externalContentId for idempotency — calling it twice for the same piece of content returns the existing record.
Status Polling: GET /api/v1/solo-accounts/{id}
Returns current account status plus a fresh onboardingUrl if onboarding is incomplete and the previous token expired. Use this to build a "complete your compliance setup" banner in your creator dashboard.
Two Webhooks
solo_account.verified fires when the creator completes ID verification and their subscription is paid. Gate upload access on this event. Don't poll, don't guess, wait for the webhook. You already have the accountId from the provisioning response, so there is nothing to wait for before you can store it.
solo_account.suspended fires if the account stops being compliant, most often a lapsed subscription. Revoke upload access. If the subscription is restored and the ID verification is still on file, the account reactivates and you get solo_account.verified again, with no second onboarding trip for the creator.
Content logging and collab scenes emit their own events (content_log.created, content_log.deleted, collab_scene.greenlit and the rest). Subscribe to what you need: the full list is in the webhook events reference.
Multi-Performer Content
For platforms handling multi-performer productions, the Collab Scenes API handles per-performer consent without anyone seeing each other's documents. Create a scene with a list of performers — each gets a magic-link email to complete their own ID verification and sign a model release. When everyone consents, your platform receives a collab_scene.greenlit webhook and can publish.
For productions where a producer documents performers ahead of time (professional studios), the Verification API lets your platform query documentation status and verify a signed RS256 JWT compliance certificate offline via JWKS. Federal inspectors and Visa auditors can verify these certificates without calling the Easy2257 API at all.
Both flows produce the same end-state: a verifiable record of every performer in every depiction, with Easy2257 holding the underlying PII as Custodian of Records.
What This Covers
A fully integrated platform satisfies:
- 18 U.S.C. § 2257 and 28 CFR Part 75 — performer ID verification, cross-reference index, 7-year retention, COR designation, inspection readiness
- Mastercard AN 5196 and Visa VIRP — model release requirement (signed during onboarding), depicted-person removal portal (live at easy2257.com/report/removal), monthly acquirer compliance reports (auto-generated on the 2nd of each month)
- TAKE IT DOWN Act (2025): a 48-hour NCII takedown SLA, timed and escalated automatically, with CSAM reports directed to the NCMEC CyberTipline instead of into the removal queue
- State-level age verification — defensible audit trail for state AG inquiries
You get all of this by shipping one API integration. We maintain it, respond to inspections, and generate the monthly reports.
Full Documentation Live at docs.easy2257.com
We've published a full developer reference at [docs.easy2257.com](https://docs.easy2257.com). It includes:
- [Quickstart guide](https://docs.easy2257.com/docs/quickstart): a working integration in five steps, with TypeScript you can paste
- [API reference](https://docs.easy2257.com/docs/api): every endpoint with its request and response shapes, generated from the OpenAPI spec
- [Platform integration guide](https://docs.easy2257.com/docs/guides/platforms): the full reference implementation, with error handling, webhook verification, and the compliance display pattern
- [Webhook signatures](https://docs.easy2257.com/docs/webhooks/signatures): verification examples in TypeScript, Express, C#, Python (Flask and FastAPI), and PHP (Laravel and plain)
- [Webhook events](https://docs.easy2257.com/docs/webhooks/events): every event we deliver, with the exact payload shape
- [Troubleshooting](https://docs.easy2257.com/docs/api/troubleshooting): the failures first integrations actually hit, and the fix for each
Getting API Access
The Partner API is available to approved partners, and getting approved is four steps:
- Create your partner account at [easy2257.com/partner/signup](/partner/signup). No cost, no minimum.
- Verify your email, then your identity. A government-ID check from your partner dashboard, the same one your creators will do.
- We review and activate you. Every partner is reviewed before their key works. Your account status has to be active or the API returns 403.
- Create your live key. In the partner dashboard, under API Keys, create a key in live mode. It starts with
ez_live_. The secret is shown once, so put it straight in your secret store.
Two things worth knowing before you write the integration:
There is no sandbox. Only ez_live_ keys are accepted. A key beginning ez_test_ is rejected with a 403 and the code TEST_MODE_UNAVAILABLE before any handler runs, and new partner accounts are issued a test key by default, so creating the live key is genuinely your first task. The reason there is no sandbox is that every v1 endpoint does the real thing: it writes production records, provisions real Easy2257 users, and sends real email. A test key that reached those handlers would do all three against live data, which is the opposite of what a sandbox is for.
So rehearse against addresses you control. Run your first end-to-end pass with your own mailboxes, watch the webhook land, then delete the content you logged. Every rejected call still shows up in your request log in the partner dashboard, so a misconfigured key is visible rather than silent.
Want to scope it before you build? Email api@easy2257.com and we'll walk the integration with you first.
The Bigger Picture
Compliance infrastructure is table stakes for any platform that accepts payments for explicit content. Visa and Mastercard have made it explicit — documented compliance isn't optional, and the monthly reporting burden is real. The platforms that build compliance in from day one have a defensible posture with processors, with acquirers, and with their legal team.
The ones that don't eventually have a very bad day.
The Partner API exists so "building compliance in from day one" takes one sprint, not one quarter.
[Start with the docs →](https://docs.easy2257.com)
This article is for informational purposes only and does not constitute legal advice.