White-label & branding

Three modes, one engine

Every FCRA partner runs on the same orders, controls, evidence, signed reports, disputes and consumer portal. The mode on your agreement decides who the consumer reporting agency is and therefore who runs the consumer-facing steps.

You choose the mode on the application (dashboard → FCRA → Settings, or POST /v1/fcra/application); the agreement fixes it. GET /v1/fcra/partner reports it as kind.

What the consumer sees, surface by surface

In direct and platform mode the consumer sees you as the requester and sees the agency where the Fair Credit Reporting Act requires the consumer reporting agency to be identified. That is the whole of the white-label rule: your brand up front, the agency’s legal name where the law puts it.

• Links go to offendersearch.app/apply/… and the portal at offendersearch.app/consumer/report. A custom domain for those pages is not available yet.
• Want the consent step inside your own product? Create the invitation with sendEmail: false and present applyUrl yourself; the page still carries your branding.
• Platform partners: register each client as an end user. Its name is what the consumer reads as the requester in the disclosure; your branding frames the page.

Set your branding

From the dashboard: FCRA → Settings → Branding (account admins). From the API: PUT /v1/fcra/branding with any of the fields below; what you send replaces what is stored. Our team seeds displayName and website from your application when it is approved.

curl -X PUT "https://api.offendersearch.app/v1/fcra/branding" \
  -H "X-API-Key: $OFFENDERSEARCH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "displayName": "Acme Staffing",
    "logoUrl": "https://acme.example/logo.png",
    "primaryColor": "#0f766e",
    "supportEmail": "screening@acme.example",
    "website": "https://acme.example",
    "replyTo": "screening@acme.example"
  }'

The BrandingStatus object

Your branding, your partner kind, and the agency named on every disclosure.

Returned or accepted by GET /v1/fcra/branding, PUT /v1/fcra/branding.

The Branding object — how the consumer sees you

Your branding on the hosted consent flow, the e-mails and the portal header.

Returned or accepted by GET /v1/fcra/partner, GET /v1/consumer/portal/report, GET /v1/fcra/branding, PUT /v1/fcra/branding, GET /v1/apply/{token}.

Preview it

On a sandbox key every account is a direct partner: set the branding, create an invitation with sendEmail: false, and open applyUrl to see the consent page exactly as a consumer would, in your colours, with the agency named in the disclosure. The sandbox sends no e-mail; the notices list shows what would have gone.

Test FCRA orders on the sandbox server

With a test key (os_test_…) every account is a sandbox FCRA partner on the sandbox server, with the same last-name rules. Register an end user, then place orders against it; nothing is billed. An order finishes right after the 202: read it once with GET /v1/fcra/orders/{orderId}.

Base URL

https://sandbox.offendersearch.app Not https://api.offendersearch.app, which takes live keys only.

Test key

In the dashboard, Developers → API keys → Create test key. Test keys begin os_test_; send yours in the X-API-Key header.

curl -X POST "https://sandbox.offendersearch.app/v1/fcra/end-users" \
  -H "X-API-Key: $OFFENDERSEARCH_TEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{
      "name": "Sample Staffing LLC",
      "permissiblePurposes": [
        "employment"
      ],
      "certification": {
        "text": "End user certifies it will use reports only for employment purposes.",
        "version": "v1",
        "certifiedAt": "2026-10-01T12:00:00Z"
      }
    }'

curl -X POST "https://sandbox.offendersearch.app/v1/fcra/orders" \
  -H "X-API-Key: $OFFENDERSEARCH_TEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{
      "endUserId": "{endUserId}",
      "permissiblePurpose": "employment",
      "consent": {
        "obtainedAt": "2026-10-01T12:00:00Z",
        "method": "esign"
      },
      "subject": {
        "firstName": "Pat",
        "lastName": "Records",
        "dob": "1980-01-01"
      },
      "searches": [
        {
          "type": "sex_offender"
        },
        {
          "type": "criminal"
        }
      ]
    }'

Try it here

Pick a scenario, edit the request, and run it against the sandbox from this page. The explorer accepts os_test_ keys only and never reaches the live host, so nothing here is billed; the “production” code it copies is for your own backend with a live key.

curl -X POST https://sandbox.offendersearch.app/v1/fcra/end-users \
  -H "X-API-Key: $OFFENDERSEARCH_TEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Sample Staffing LLC", "permissiblePurposes": [ "employment" ], "certification": { "text": "End user certifies it will use reports only for employment purposes.", "version": "v1", "certifiedAt": "2026-10-01T12:00:00Z" } }'

Every test name: FCRA API sandbox orders·Postman collection·FCRA API sandbox