How it works: the three ways to use the FCRA API

Which one are you?

All three share the same engine. The mode changes two things: who is named as the consumer reporting agency on the disclosure, the report and the notices, and therefore who runs the consumer-facing steps. Everything below that line — the searches, the controls, the evidence, the signed report, disputes and the consumer portal — is identical.

Direct: an employer, landlord or organization screening for itself

1. Apply once. Dashboard → FCRA → Settings, or POST /v1/fcra/application: your company, a compliance contact, the purposes (employment, tenant screening…), the certifications, a signature. We review it and switch access on when the agreement is signed. Build against the sandbox meanwhile; every test key is already a direct partner.
2. Set your branding. Your name, logo and colour go on everything the consumer sees; the agency’s legal name stays on the disclosure, the report and the notices. White-label.
3. Register your end user. For a direct partner that is usually yourself: your legal name and the purposes you hold. One call, once.
4. Invite the person. POST /v1/fcra/invitations with their name and e-mail, the searches, and where the job or housing is. We e-mail a link in your branding (or you present it inside your own product).
5. They read and sign. The summary of their rights, the standalone disclosure, the notices their state adds; then their legal name, date of birth, other names, where they have lived; then the authorization, signed by typing their name. No Social Security number is asked for; identity verification is coming soon. The signed consent is stored as a PDF with the order.
6. The order runs. The search plan is computed from their addresses (Search scope); registries and criminal sources are searched, every positive is re-verified live (with liveScope: "matches", confirmed with the agency that keeps it, and held until it is), the controls run, the evidence is captured, the report is rendered and signed. Minutes, not days. You are told by webhook; the dashboard shows it.
7. Read the result. clear, records_found or incomplete, per search, with the coverage table that says exactly what each rests on. The consumer gets their copy if they asked, with the access code to the portal.
8. Decide. Record engaged or cleared, or start adverse action: we send the pre-adverse notice with the report, wait the period the location requires, and send the post-adverse notice. A dispute pauses the clock; a correction revises the report. Adverse action.
9. Keep watching, if you want. Enroll the person in a continuous check with an evergreen authorization; a new order is placed only when something reportable appears. Continuous checks.

Platform: screening for your clients under your brand

The same nine steps, with two differences. Each client is an end user you register — its legal name is what the consumer reads as the requester in the disclosure, inside your branded page. And your branding frames every consumer-facing surface: the invitation e-mail, the consent page, the copy of the report, the adverse-action notices and the portal carry your name, logo and colour; the consumer reporting agency’s legal name appears where the law requires it. Orders, invitations and continuous checks are placed per end user, and every list filters by endUserId.

• Want the consent step inside your own product? Create the invitation with sendEmail: false and present applyUrl yourself.
• Want your clients to place orders themselves? Give each a seat on your account, or call the API from your product with your key.
• Your clients never need their own agreement; your agreement and your certification of each end user cover them.

CRA: the data, the controls and the evidence for your own reports

1. Apply as a consumer reporting agency; your agreement names the purposes.
2. Register your end users — the employers and landlords you furnish to — with the certifications you hold from them.
3. Place orders with the consent attestation you collected (or attach your consent document). The order runs as above.
4. Read the result and furnish it in your own report. The signed report, the receipt and the evidence captures are yours to pass on; the consumer portal access code goes in your consumer copy.
5. Disputes opened with you go to POST /v1/fcra/orders/{id}/disputes; disputes opened in the portal reach you by webhook. We reinvestigate with the source on the 30-day clock and revise the report.
6. Consent, notices and adverse action stay in your own process, as the CRA.

What the consumer experiences

1. An e-mail from your organization: “[Your organization] has asked for your authorization for a background check”, with a link that lives seven days.
2. A page in your colours. Their rights, the disclosure naming the agency, their state’s notices; their details; the typed signature. No Social Security number.
3. If they asked for a copy: an e-mail when the report is ready, with the portal link and their access code. In the portal they see exactly what was reported, which sources were searched live, and can dispute any item.
4. If a decision goes against them: the pre-adverse notice with the report and the time to respond; later, the post-adverse notice with the agency’s contact and their rights.
5. If they dispute: a receipt, a reinvestigation within 30 days, the outcome, and a revised report if anything changed.

Timing and cost

• Turnaround: an order usually completes in minutes; live re-verification of each positive and live discovery in the relevant states are what take the time. The order carries an eta. With liveScope: "matches" a consumer with no possible record is answered from our current data; a possible record the agency has not confirmed yet is held, and the search is updated when it answers.
• The consumer’s side: the invitation lives up to 30 days; the adverse-action waiting period is at least 7 days by default and longer where the location requires it.
• Pricing: $4.95 per order, billed once per order as the fcra_order usage line. Every search in the order is included — sex offender, criminal court and healthcare — along with every live check, with no court fees or extra charges. A custom per-order price, set in your partner agreement, replaces the $4.95. Sandbox orders are never billed. Your usage also lists fcra_search_*, fcra_live_source and fcra_monitor_evaluation counts for reference; they are not charged.
• Coming soon: identity verification (government ID and selfie) and address-history trace. Every order already carries an identity block that says what the order was matched on.

Test FCRA orders on the sandbox server

With a test key (os_test_…) every account is a sandbox FCRA partner on the sandbox server, with the same last-name rules. Register an end user, then place orders against it; nothing is billed. An order finishes right after the 202: read it once with GET /v1/fcra/orders/{orderId}.

Base URL

https://sandbox.offendersearch.app Not https://api.offendersearch.app, which takes live keys only.

Test key

In the dashboard, Developers → API keys → Create test key. Test keys begin os_test_; send yours in the X-API-Key header.

curl -X POST "https://sandbox.offendersearch.app/v1/fcra/end-users" \
  -H "X-API-Key: $OFFENDERSEARCH_TEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{
      "name": "Sample Staffing LLC",
      "permissiblePurposes": [
        "employment"
      ],
      "certification": {
        "text": "End user certifies it will use reports only for employment purposes.",
        "version": "v1",
        "certifiedAt": "2026-10-01T12:00:00Z"
      }
    }'

curl -X POST "https://sandbox.offendersearch.app/v1/fcra/orders" \
  -H "X-API-Key: $OFFENDERSEARCH_TEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{
      "endUserId": "{endUserId}",
      "permissiblePurpose": "employment",
      "consent": {
        "obtainedAt": "2026-10-01T12:00:00Z",
        "method": "esign"
      },
      "subject": {
        "firstName": "Pat",
        "lastName": "Records",
        "dob": "1980-01-01"
      },
      "searches": [
        {
          "type": "sex_offender"
        },
        {
          "type": "criminal"
        }
      ]
    }'

Try it here

Pick a scenario, edit the request, and run it against the sandbox from this page. The explorer accepts os_test_ keys only and never reaches the live host, so nothing here is billed; the “production” code it copies is for your own backend with a live key.

curl -X POST https://sandbox.offendersearch.app/v1/fcra/end-users \
  -H "X-API-Key: $OFFENDERSEARCH_TEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Sample Staffing LLC", "permissiblePurposes": [ "employment" ], "certification": { "text": "End user certifies it will use reports only for employment purposes.", "version": "v1", "certifiedAt": "2026-10-01T12:00:00Z" } }'

Every test name: FCRA API sandbox orders·Postman collection·FCRA API sandbox