# Platform

> The conventions every product shares, written once. Product pages document only their exceptions.

- **HTML:** https://offendersearch.app/docs/platform
- **Base URL (live):** https://api.offendersearch.app — live keys (`os_live_…`)
- **Base URL (sandbox):** https://sandbox.offendersearch.app — test keys (`os_test_…`), never billed
- **Authentication:** `X-API-Key` request header
- **OpenAPI:** https://offendersearch.app/openapi.json · https://offendersearch.app/openapi.yaml
- **Docs index for agents:** https://offendersearch.app/llms.txt

## One platform, several APIs

Every product — [Sex Offender Search](/docs/sex-offender), [Criminal Records](/docs/criminal), [Monitoring](/docs/monitoring), the [Map API](/docs/map) and the [FCRA Partner API](/docs/fcra) — is served from the same host with the same key, the same authentication header, the same error body and the same sandbox. Learn these once.

| Convention | Value |
| --- | --- |
| Live base URL | `https://api.offendersearch.app` |
| Sandbox base URL | `https://sandbox.offendersearch.app` — test keys only, never billed |
| Base path | `/v1` on every endpoint |
| Authentication | `X-API-Key: <key>` request header |
| Key prefixes | `os_live_…` for production, `os_test_…` for the sandbox |
| Content type | JSON request bodies and responses; PDFs for reports and evidence |
| Errors | HTTP status + a JSON body with `detail` (string, list or object — see [errors](/docs/platform/errors-and-retries)) |

## In this section

- [Getting started in five minutes](https://offendersearch.app/docs/platform/getting-started): account, key, first request, first response
- [Authentication & keys](https://offendersearch.app/docs/platform/authentication): the header, key lifecycle, rotation, organisation credentials, secure handling
- [Sandbox & production](https://offendersearch.app/docs/platform/environments): the two hosts, test keys, fixed test names, going live
- [Requests & responses](https://offendersearch.app/docs/platform/requests): versions, pagination, timeouts, deadlines, request identifiers, billing events
- [Errors, rate limits & retries](https://offendersearch.app/docs/platform/errors-and-retries): the error body, 429 and Retry-After, what to retry and what never to
- [Async jobs & webhooks](https://offendersearch.app/docs/platform/async-and-webhooks): 202 + poll, webhookUrl, signing, idempotency
- [Data model rules](https://offendersearch.app/docs/platform/data-model): normalized vs original values, provenance, completeness, missing vs null vs empty, dates
- [Operations](https://offendersearch.app/docs/platform/operations): usage, billing, production checklist, health, troubleshooting, support