Create an API key (secret shown once)

Creates a secret key by default. Send kind: "map_publishable" with allowedOrigins to create a map browser key (os_map_pk_…) instead.

A map browser key is accepted only on GET /v1/map/viewport, GET /v1/map/groups/{groupId}, GET /v1/map/records/{markerId} and GET /v1/map/status, and only when the request's Origin is on the key's list. Every other route answers it 401. Phone apps have no web origin: call from your server with a secret key.

post/v1/keys

Request

  • Base URL: https://api.offendersearch.app
  • URL: https://api.offendersearch.app/v1/keys
  • Auth: HTTP bearer

Request body

namestring
freshnessstring[] nullable

LEGACY/UNENFORCED. Freshness is a PER-REQUEST parameter on /v1/search and is NOT provisioned on the key — any valid key may send daily or weekly and is billed accordingly. This field is retained for compatibility and does not gate anything.

proofboolean nullable

Whether the key may request proof docs. Defaults true.

kind'secret' | 'map_publishable'

secret is an ordinary key. map_publishable is a map browser key; it needs allowedOrigins.

allowedOriginsstring[] nullable

For a map browser key: the sites it may be used from. Each entry is a scheme and host, e.g. https://example.com. https://*.example.com matches subdomains. http:// is for localhost only.

Response

Key created. secret is returned ONCE here; only its hash is stored.

idstring
namestring
maskedKeystring

Prefix + ellipsis; the full secret is never re-shown.

createdAtstring date-time
lastUsedAtstring date-time nullable
status'active' | 'revoked'
kind'secret' | 'map_publishable'

secret for an ordinary key; map_publishable for a map browser key.

allowedOriginsstring[]

The sites a map browser key may be used from. Empty for a secret key.

secretstring

Full key secret — returned ONCE on create/rotate; only its hash is stored.

Changes

No recorded changes to this operation across all 1 revision of this API.