Access, keys & data handling

The X-API-Key header

Authenticate every /v1/monitors* request with your secret key in the X-API-Key header. Keys are created, named, rotated and revoked from the API keys page, and a key’s secret is shown in full only once, at creation. It is the same key you already use for the Sex Offender API and the Criminal Search API — this is a product on your existing account, not a separate credential.

curl "https://api.offendersearch.app/v1/monitors" \
  -H "X-API-Key: os_live_…"

A missing or malformed key returns 401 unauthenticated, in the standard error envelope with a stable error.code.

Monitoring is available on every account

There is nothing to enable and no entitlement to request. Any valid key can create, list, retrieve and cancel monitors and read their alert history immediately. Usage is attributed per key, so issue one key per environment or service.

Rotation. Issue a second key, deploy it, then revoke the first — both are valid at once, so rotation needs no downtime window.

Security posture

• Encryption. TLS in transit, AES-256 at rest for stored monitors and alerts.
• Per-key hashing. Secrets are hashed at rest — a database read never exposes a usable key.
• Tenant isolation. Monitors, alerts and channels are scoped per account; one customer can never read another’s.
• Least privilege. A key authenticates you and nothing more; there are no per-key feature flags.
• Audit logging. Every request is logged with account, timestamp and endpoint.
• Attestations. A Business Associate Agreement (BAA) is available to eligible enterprise accounts.

How a monitor stores its criteria

A monitor persists the criteria you register so it can be evaluated day after day. The monitored person’s name and date of birth — and, for a location monitor, the subscriber’s own address (or coordinates and radius) — are stored encrypted, isolated to your account, and written to the audit log like any other request. They are used for one purpose only: to evaluate matches and, for a location monitor, proximity. They are never shared between accounts and never surfaced in another customer’s data.

Legal

The Monitoring API is not a consumer reporting agency and its alerts are not a consumer report. You may not use monitoring for employment, tenant screening, credit, insurance, or any other purpose covered by the FCRA — a restriction that is especially load-bearing here, because a monitor runs unattended and could otherwise feed an automated adverse decision. Honouring it is a condition of access, stated verbatim in the legal notice that accompanies every monitor and every alert. There is no parameter that removes it.