Data API Access object

Every Data API response includes an access object. It describes what your request asked for, the publisher and page signals Iframely found for the URL, and the resulting access decision Iframely made for each content type.

Use access to understand why content was or wasn’t returned, and to make your own decisions about how to use the returned content.

Some decisions cannot be formalized by Iframely. For example, Iframely does not attempt to interpret free-form comments from publishers in their robots.txt.

See publisher explanation for how processing modes, publisher signals, and controls affect content availability. See Data API content for what entities, excerpt, and fulltext contain.

API example

"access": {

    "requested": {
        "modes": ["assist"],
        "use": "reference"
    },

    "signals": {
        "license": {
            "url": "https://creativecommons.org/licenses/by-sa/4.0/deed.en",
            "name": "Creative Commons Attribution-ShareAlike 4.0 International",
            "common_name": "CC BY-SA 4.0",
            "type": "CC"
        },
        "robots.txt": {
            "url": "https://en.wikipedia.org/robots.txt",
            "status": 200,
            "sitemap": "https://en.wikipedia.org/w/rest.php/site/v1/sitemap/0",
            "updated_at": "2026-09-16T15:33:44.130Z"
        },
        "directives": {
            "max-image-preview": "standard"
        }
    },

    "decision": {
        "meta": {
            "iframely_default": true,
            "supported_by": ["license"],
            "allowed": true
        },
        "links": {
            "iframely_default": true,
            "supported_by": ["max-image-preview", "license"],
            "allowed": true
        },
        "entities": {
            "iframely_default": false,
            "promoted_by": ["license"],
            "allowed": true
        },
        "excerpt": {
            "iframely_default": false,
            "promoted_by": ["license"],
            "allowed": true
        },
        "fulltext": {
            "iframely_default": false,
            "promoted_by": ["license"],
            "allowed": true
        }
    }
}

Requested

requested shows the processing mode and use value declared by your request.

modes — the processing mode used for the request, wrapped as a list for possible future changes. See Processing modes.
use — the optional use value declared by the request. See The use signal.

Signals

signals contains the publisher and page signals Iframely found for the URL that are relevant to the access decision.

Only detected signals are included. For example, if no recognized license is found, there will be no license entry.

The main signal sources are:

robots.txt — the publisher’s robots.txt, including its URL and response status. When available, it can also include a sitemap, update time, matching Allow rules, or publisher comment. See RFC 9309, the Robots Exclusion Protocol.
directives — robots directives found on the page, see Google’s documentation.
machine-features — AI-era signals, including Content Signals, a discovered llms.txt, and whether the publisher provides Markdown when requested.
license — a recognized license declared by the publisher. For example, a Creative Commons license or RSL. It can include the license URL, name, common name, and type.

See guide for publishers for more information about signals recognized by Iframely.

These are the signals available to your application. Not every input to an access decision is represented in signals. For example, explicit publisher settings in the Iframely dashboard and Iframely’s default policy are reflected in decision directly rather than exposed as signals.

Decision

decision contains an entry for each content type in the Data API response:

meta, links, entities, excerpt, and fulltext.

Each entry includes:

iframely_default — whether the content type is available for the requested mode under Iframely’s default policy.
allowed — the final access decision.

The decision may also include supported_by, promoted_by, or blocked_by lists to show what factors contributed to the decision and Iframely’s interpretation of the signals.

Iframely default processing policy

Supporting and promoting signals

When a content type is already allowed by default, a publisher or page signal that supports that access appears in supported_by.

When a content type is not allowed by default, a publisher or page signal that promotes that access appears in promoted_by.

For example:

"entities": {
    "iframely_default": false,
    "promoted_by": ["license"],
    "allowed": true
}

Here, entities is not available for the requested mode under Iframely’s default policy, but the publisher’s license provides a signal that promotes it.

Blocking signals

A publisher or page signal can also block content that would otherwise be available. Such signals appear in blocked_by. Any single block always results in "allowed": false.

"fulltext": {
    "iframely_default": false,
    "promoted_by": ["license", "markdown"],
    "blocked_by": ["explicit_publisher_permissions"],
    "allowed": false
}

Reference values

The values in supported_by, promoted_by, and blocked_by lists identify the signals that contributed to the decision.

They generally use the signal’s human- and AI-readable name, such as license, content-signal, max-snippet, articleBody, or llms.txt. These references can generally be found in signals fields or elsewhere in the API response. For example, articleBody is nested in entities.

When a property name is too generic on its own, the value is prefixed with the parent object, such as directives:follow or robots.txt:allow.

Some decision inputs do not appear in signals:

explicit_publisher_permissions identifies an explicit permission or restriction set by the publisher in the Iframely dashboard.
Iframely’s default policy is represented by iframely_default.

This keeps signals focused on publisher and page signals while the decision object shows Iframely’s interpretation.

Error handling

An access object is returned when Iframely fetched the original page and can make an access decision for the requested URL.

If the request is blocked before that decision can be made — for example, by a robots.txt Disallow rule or an error from the origin server — the Data API returns a top-level error instead.