Access & keys
The X-API-Key header, automatic access to Criminal Search and live mode, and what a key controls.
Base URL https://api.offendersearch.appThe X-API-Key header
Authenticate every /v1/criminal/* request with your secret key in the X-API-Key header. Keys are created, named, rotated and revoked from the API keys page, and a key’s secret is shown in full only once, at creation. It is the same key you already use for the Sex Offender API — this is a product on your existing account, not a separate credential.
curl "https://api.offendersearch.app/v1/criminal/jurisdictions?state=TX" \
-H "X-API-Key: os_live_…"A missing or malformed key returns 401 unauthenticated, in the standard error envelope with a stable error.code.
Criminal Search and live verification are automatic
There is nothing to enable and no entitlement to request:
- Criminal Search is available on every account. Any valid key can call every
/v1/criminal/*endpoint immediately — search, coverage, resolver, and reports. - Live verification is included too. A
liverequest works from any account with no separate add-on. You pay per live source you actually consult (see Coverage), but nothing is gated behind an entitlement.
GET /v1/criminal/sources needs no key at all, so you can audit coverage before you even sign up. See Coverage today.What a key controls
An API key carries no per-key feature flags of its own — it simply authenticates you. Every option in these docs — nameStrategy, include, live, prefixMatch — is a per-request parameter available to any key on any account.
Rotation. Issue a second key, deploy it, then revoke the first — both are valid at once, so rotation needs no downtime window. Usage is attributed per key, which is the practical reason to issue one key per environment or per service rather than sharing a single credential across a fleet.
Already have an account and a key? You can start calling /v1/criminal/* right now — no activation step.
Legal
The Criminal Search API is not a consumer reporting agency and this data is not a consumer report. You may not use it for employment, tenant screening, credit, insurance, or any other purpose covered by the FCRA. Honouring that restriction is a condition of access, stated verbatim in the legal block of every search, batch-row and async-job response — there is no request parameter that removes it.