# Access, keys & data handling

> Authenticate with the X-API-Key header on every monitoring call, and see how a monitor stores its criteria — encrypted, per-account isolated, and audit-logged.

- **HTML:** https://offendersearch.app/docs/monitoring/authentication
- **Base URL:** https://api.offendersearch.app
- **Authentication:** `X-API-Key` request header
- **OpenAPI:** https://offendersearch.app/openapi.json · https://offendersearch.app/openapi.yaml
- **Monitoring reference as markdown:** https://offendersearch.app/docs/monitoring.md

## The X-API-Key header

Authenticate every `/v1/monitors*` request with your secret key in the `X-API-Key` header. Keys are created, named, rotated and revoked from the dashboard, and a key's secret is shown in full only once, at creation. It is the **same** key you already use for the Sex Offender API and the Criminal Search API.

```bash
curl "https://api.offendersearch.app/v1/monitors" \
  -H "X-API-Key: os_live_…"
```

A missing or malformed key returns `401 unauthenticated`.

## Monitoring is available on every account

There is no product to enable and no entitlement to request. Any valid key can create, list, retrieve and cancel monitors and read their alert history immediately. Usage is attributed per key, so issue one key per environment or service.

**Rotation.** Issue a second key, deploy it, then revoke the first — both are valid at once, so rotation needs no downtime window.

## Security posture

- **Encryption.** TLS in transit, AES-256 at rest for stored monitors and alerts.
- **Per-key hashing.** Secrets are hashed at rest — a database read never exposes a usable key.
- **Tenant isolation.** Monitors, alerts and channels are scoped per account; one customer can never read another’s.
- **Least privilege.** A key authenticates you and nothing more; there are no per-key feature flags.
- **Audit logging.** Every request is logged with account, timestamp and endpoint.
- **Attestations.** A Business Associate Agreement (BAA) is available to eligible enterprise accounts.

## How a monitor stores its criteria

A monitor persists the criteria you register so it can be evaluated day after day. The monitored person’s name and date of birth — and, for a location monitor, the subscriber’s own address (or coordinates and radius) — are stored **encrypted**, isolated to your account, and written to the audit log like any other request. They are used for one purpose only: to evaluate matches and, for a location monitor, proximity. They are never shared between accounts and never surfaced in another customer’s data.

## Legal

The Monitoring API is not a consumer reporting agency and its alerts are not a consumer report. You may not use monitoring for employment, tenant screening, credit, insurance, or any other FCRA-covered purpose — a restriction that is especially load-bearing here, because a monitor runs unattended and could otherwise feed an automated adverse decision. The notice — *Not a consumer report. This information may not be used for any purpose under the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.).* — accompanies every monitor and every alert, and there is no parameter that removes it.

---

## Related

- Previous: [Quickstart](https://offendersearch.app/docs/monitoring/quickstart.md)
- Next: [The Monitor object](https://offendersearch.app/docs/monitoring/monitor-object.md)
- Index: [Monitoring API reference](https://offendersearch.app/docs/monitoring.md)