Search API

The Search API provides multiple ways to find and verify public-record information through a single integration.

Getting Started

1. Contact your Infocus Info representative to set up your company and users.

2. Sign in to the Infocus Info Console and generate an API key from the Account menu.

3. Use the API key as a Bearer token in the Authorization header for each API request:

   Authorization: Bearer your-api-key

Code Samples

Request examples are shown for cURL, the IntelliJ HTTP Client, Java, and C#. The Java samples use the JDK's built-in java.net.http client (Java 17 or later). The C# samples use HttpClient with top-level statements and raw string literals (.NET 7 or later, with implicit usings enabled). Replace your-api-key with your own key. The uuid and identifier values in sample responses are synthetic.

Available Search Types

Available

Instant Criminal Search

Run a real-time search of criminal records across national and state-level databases.

Available

Screening Address Trace (SAT)

Find names, aliases, address history, and counties by SSN or name and date of birth. Available for enabled accounts.

Available

Person Search

Look up names, aliases, address history, phone numbers, emails, and relatives by SSN or name and date of birth. Available for enabled accounts.

Available

County Verification

Search a county's court records for a subject's criminal case history. Results complete asynchronously. Available for enabled accounts.

Webhooks

Every search endpoint accepts a webhookUrl (required for County Verification, optional for the others). The API saves the search, replies with a uuid, and sends the finished result to your URL when it completes. Each search page describes the option for that search under Webhooks: Instant Criminal, SAT, Person Search, and County Verification.

Verifying a webhook

Deliveries are signed per the Standard Webhooks specification. The signature is HMAC-SHA256(key, "{webhook-id}.{webhook-timestamp}.{body}"), base64 encoded and prefixed with v1,, where the key is the API key that placed the search. Compute it over the raw request body before parsing, compare in constant time, and reject timestamps more than a few minutes old. Use webhook-id (the search's uuid) as an idempotency key, since delivery is at least once.

Java

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;
import java.util.Base64;
import java.util.Map;

static boolean verify(String apiKey, Map<String, String> headers, String rawBody) throws Exception {
    String id = headers.get("webhook-id");
    String timestamp = headers.get("webhook-timestamp");
    if (Math.abs(Instant.now().getEpochSecond() - Long.parseLong(timestamp)) > 300) return false;

    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(apiKey.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
    byte[] digest = mac.doFinal((id + "." + timestamp + "." + rawBody).getBytes(StandardCharsets.UTF_8));
    byte[] expected = ("v1," + Base64.getEncoder().encodeToString(digest)).getBytes(StandardCharsets.UTF_8);

    for (String entry : headers.get("webhook-signature").split(" ")) {
        if (MessageDigest.isEqual(entry.getBytes(StandardCharsets.UTF_8), expected)) return true;
    }
    return false;
}

C#

using System.Security.Cryptography;
using System.Text;

static bool Verify(string apiKey, IDictionary<string, string> headers, string rawBody)
{
    var id = headers["webhook-id"];
    var timestamp = headers["webhook-timestamp"];
    if (Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - long.Parse(timestamp)) > 300) return false;

    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(apiKey));
    var digest = hmac.ComputeHash(Encoding.UTF8.GetBytes($"{id}.{timestamp}.{rawBody}"));
    var expected = Encoding.UTF8.GetBytes("v1," + Convert.ToBase64String(digest));

    return headers["webhook-signature"].Split(' ')
        .Any(entry => CryptographicOperations.FixedTimeEquals(Encoding.UTF8.GetBytes(entry), expected));
}

If you use a Standard Webhooks library, pass it the secret whsec_ followed by the base64 encoding of your API key. If the API key that placed the search has been revoked or has expired, the delivery cannot be signed and is abandoned. To test, use a request inspector such as webhook.site: the URL must be https and publicly resolvable.