# How it works: the three ways to use the FCRA API

> Employers and landlords screening for themselves, platforms screening for their clients, and consumer reporting agencies: the full journey for each, step by step, from invitation to decision.

- **HTML:** https://offendersearch.app/docs/fcra/how-it-works
- **Base URL (live):** https://api.offendersearch.app — live keys (`os_live_…`)
- **Base URL (sandbox):** https://sandbox.offendersearch.app — test keys (`os_test_…`), never billed; see https://offendersearch.app/docs/fcra/sandbox.md
- **Authentication:** `X-API-Key` request header, on an account with FCRA Partner Access
- **FCRA API reference as markdown:** https://offendersearch.app/docs/fcra.md

## Which one are you?

| If you… | Your mode | Who the consumer reporting agency is | Start with |
| --- | --- | --- | --- |
| hire people, rent homes, or vet volunteers and staff for your own organization | `direct` | We are | [Hosted consent](/docs/fcra/hosted-consent) |
| run a product or service that screens for other businesses (a platform, a staffing firm, a property manager) | `platform` | We are; your clients are end users you register | [Hosted consent](/docs/fcra/hosted-consent) and [White-label](/docs/fcra/white-label) |
| are a consumer reporting agency building a registry and criminal layer into your own reports | `cra` | You are | [Orders](/docs/fcra/orders) |

All three share the same engine. The mode changes two things: who is named as the consumer reporting agency on the disclosure, the report and the notices, and therefore who runs the consumer-facing steps. Everything below that line — the searches, the controls, the evidence, the signed report, disputes and the consumer portal — is identical.

## Direct: an employer, landlord or organization screening for itself

1. **Apply once.** Dashboard → FCRA → Settings, or `POST /v1/fcra/application`: your company, a compliance contact, the purposes (employment, tenant screening…), the certifications, a signature. We review it and switch access on when the agreement is signed. Build against the sandbox meanwhile; every test key is already a `direct` partner.
2. **Set your branding.** Your name, logo and colour go on everything the consumer sees; the agency’s legal name stays on the disclosure, the report and the notices. [White-label](/docs/fcra/white-label).
3. **Register your end user.** For a direct partner that is usually yourself: your legal name and the purposes you hold. One call, once.
4. **Invite the person.** `POST /v1/fcra/invitations` with their name and e-mail, the searches, and where the job or housing is. We e-mail a link in your branding (or you present it inside your own product).
5. **They read and sign.** The summary of their rights, the standalone disclosure, the notices their state adds; then their legal name, date of birth, other names, where they have lived; then the authorization, signed by typing their name. No Social Security number is asked for; identity verification is coming soon. The signed consent is stored as a PDF with the order.
6. **The order runs.** The search plan is computed from their addresses ([Search scope](/docs/fcra/scope)); registries and criminal sources are searched, every positive is re-verified live (with `liveScope: "matches"`, confirmed with the agency that keeps it, and held until it is), the controls run, the evidence is captured, the report is rendered and signed. Minutes, not days. You are told by webhook; the dashboard shows it.
7. **Read the result.** `clear`, `records_found` or `incomplete`, per search, with the coverage table that says exactly what each rests on. The consumer gets their copy if they asked, with the access code to the portal.
8. **Decide.** Record `engaged` or `cleared`, or start adverse action: we send the pre-adverse notice with the report, wait the period the location requires, and send the post-adverse notice. A dispute pauses the clock; a correction revises the report. [Adverse action](/docs/fcra/adverse-action).
9. **Keep watching, if you want.** Enroll the person in a continuous check with an evergreen authorization; a new order is placed only when something reportable appears. [Continuous checks](/docs/fcra/continuous-checks).

## Platform: screening for your clients under your brand

The same nine steps, with two differences. **Each client is an end user you register** — its legal name is what the consumer reads as the requester in the disclosure, inside your branded page. And **your branding frames every consumer-facing surface**: the invitation e-mail, the consent page, the copy of the report, the adverse-action notices and the portal carry your name, logo and colour; the consumer reporting agency’s legal name appears where the law requires it. Orders, invitations and continuous checks are placed per end user, and every list filters by `endUserId`.

- Want the consent step inside your own product? Create the invitation with `sendEmail: false` and present `applyUrl` yourself.
- Want your clients to place orders themselves? Give each a seat on your account, or call the API from your product with your key.
- Your clients never need their own agreement; your agreement and your certification of each end user cover them.

## CRA: the data, the controls and the evidence for your own reports

1. **Apply** as a consumer reporting agency; your agreement names the purposes.
2. **Register your end users** — the employers and landlords you furnish to — with the certifications you hold from them.
3. **Place orders** with the consent attestation you collected (or attach your consent document). The order runs as above.
4. **Read the result and furnish it** in your own report. The signed report, the receipt and the evidence captures are yours to pass on; the consumer portal access code goes in your consumer copy.
5. **Disputes** opened with you go to `POST /v1/fcra/orders/{id}/disputes`; disputes opened in the portal reach you by webhook. We reinvestigate with the source on the 30-day clock and revise the report.
6. **Consent, notices and adverse action stay in your own process**, as the CRA.

## What the consumer experiences

1. An e-mail from your organization: “[Your organization] has asked for your authorization for a background check”, with a link that lives seven days.
2. A page in your colours. Their rights, the disclosure naming the agency, their state’s notices; their details; the typed signature. No Social Security number.
3. If they asked for a copy: an e-mail when the report is ready, with the portal link and their access code. In the portal they see exactly what was reported, which sources were searched live, and can dispute any item.
4. If a decision goes against them: the pre-adverse notice with the report and the time to respond; later, the post-adverse notice with the agency’s contact and their rights.
5. If they dispute: a receipt, a reinvestigation within 30 days, the outcome, and a revised report if anything changed.

## Timing and cost

- **Turnaround:** an order usually completes in minutes; live re-verification of each positive and live discovery in the relevant states are what take the time. The order carries an `eta`. With `liveScope: "matches"` a consumer with no possible record is answered from our current data; a possible record the agency has not confirmed yet is held, and the search is updated when it answers.
- **The consumer’s side:** the invitation lives up to 30 days; the adverse-action waiting period is at least 7 days by default and longer where the location requires it.
- **Pricing:** $4.95 per order, billed once per order as the `fcra_order` usage line. Every search in the order is included — sex offender, criminal court and healthcare — along with every live check, with no court fees or extra charges. A custom per-order price, set in your partner agreement, replaces the $4.95. Sandbox orders are never billed. Your usage also lists `fcra_search_*`, `fcra_live_source` and `fcra_monitor_evaluation` counts for reference; they are not charged.
- **Coming soon:** identity verification (government ID and selfie) and address-history trace. Every order already carries an `identity` block that says what the order was matched on.

---

## Related

- Next: [Access & end users](https://offendersearch.app/docs/fcra/access.md)
- Index: [FCRA API reference](https://offendersearch.app/docs/fcra.md)