Access, keys & data handling

The X-API-Key header

Authenticate every /v1/monitors* request with your secret key in the X-API-Key header. Keys are created, named, rotated and revoked from the API keys page, and a key’s secret is shown in full only once, at creation. It is the same key you already use for the Sex Offender API and the Criminal Search API — this is a product on your existing account, not a separate credential.

curl "https://api.offendersearch.app/v1/monitors" \
  -H "X-API-Key: os_live_…"

A missing or invalid key returns 401 with {"detail": "Provide a valid X-API-Key or session token."} — the error envelope every monitoring endpoint uses.

Monitoring is available on every account

There is nothing to enable and no entitlement to request. Any secret API key on an account with an active subscription or free trial can create, list, retrieve and cancel monitors and read their alert history immediately; without either, the call is a 402. Monitors belong to the account, not to the key that created them, so every key on the account lists and manages the same monitors.

Rotation. Issue a second key, deploy it, then revoke the first — both are valid at once, so rotation needs no downtime window.

Security posture

• Encryption. TLS in transit, AES-256 at rest for stored monitors and alerts.
• Per-key hashing. Secrets are hashed at rest — a database read never exposes a usable key.
• Tenant isolation. Monitors, alerts and channels are scoped per account; one customer can never read another’s.
• Least privilege. A key authenticates you and nothing more; there are no per-key feature flags.
• Attestations. A Business Associate Agreement (BAA) is available to eligible enterprise accounts.

How a monitor stores its criteria

A monitor persists the criteria you register so it can be evaluated day after day. The monitored person’s name and date of birth — and, for a location monitor, the subscriber’s own address (or coordinates and radius) — are stored encrypted at rest and isolated to your account. They are used to evaluate the monitor and to name it in its own alerts. They are never shared between accounts and never surfaced in another customer’s data.

Legal

Monitoring alerts are not a consumer report, and monitoring is not part of FCRA Partner Access. You may not use monitoring for employment, tenant screening, credit, insurance, or any other purpose covered by the FCRA — a restriction that is especially load-bearing here, because a monitor runs unattended and could otherwise feed an automated adverse decision. Honouring it is a condition of access, and every alert email states it in its footer. There is no parameter that removes it.