# Access & keys

> Authenticate with the X-API-Key header on every criminal call. Criminal Search and live mode are available on every account automatically — no entitlement to enable; the sources endpoint needs no key at all.

- **HTML:** https://offendersearch.app/docs/criminal/authentication
- **Base URL:** https://api.offendersearch.app
- **Authentication:** `X-API-Key` request header
- **OpenAPI:** https://offendersearch.app/openapi.json · https://offendersearch.app/openapi.yaml
- **Criminal reference as markdown:** https://offendersearch.app/docs/criminal.md

## The X-API-Key header

Authenticate every `/v1/criminal/*` request with your secret key in the `X-API-Key` header. Keys are created, named, rotated and revoked from the dashboard, and a key's secret is shown in full only once, at creation. It is the **same** key you already use for the Sex Offender API.

```bash
curl "https://api.offendersearch.app/v1/criminal/jurisdictions?state=TX" \
  -H "X-API-Key: os_live_…"
```

A missing or malformed key returns `401 unauthenticated`.

## Criminal Search and live verification are automatic

- **Criminal Search is available on every account** — there is no product to enable and no entitlement to request. Any valid key can call every `/v1/criminal/*` endpoint immediately.
- **Live verification** is included too: a `live` block works from any account with no separate add-on. You pay per live source you actually consult (see billing) — but nothing is gated behind an entitlement.

The one endpoint that needs **no key at all** is `GET /v1/criminal/sources` — so you can audit coverage before you even sign up.

## What a key controls

An API key carries **no** per-key feature flags of its own — it simply authenticates you. Every option in these docs — `nameStrategy`, `include`, `live`, `prefixMatch` — is a per-request parameter available to any key on any account.

**Rotation.** Issue a second key, deploy it, then revoke the first — both are valid at once, so rotation needs no downtime window. Usage is attributed per key, so issue one key per environment or service.

## Legal

The Criminal Search API is not a consumer reporting agency and this data is not a consumer report. You may not use it for employment, tenant screening, credit, insurance, or any other FCRA-covered purpose. The notice — *Not a consumer report. This information may not be used for any purpose under the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.).* — is present in the `legal` block of every search, batch-row and async-job response, and there is no request parameter that removes it.

---

## Related

- Previous: [Quickstart](https://offendersearch.app/docs/criminal/quickstart.md)
- Next: [Errors & status codes](https://offendersearch.app/docs/criminal/errors.md)
- Index: [Criminal Search API reference](https://offendersearch.app/docs/criminal.md)