Authentication
Send your key as a bearer token. X-Api-Key is also accepted.
Authorization: Bearer pc_live_3kd9…
Key modes
| Prefix | Host | Behavior |
|---|---|---|
pc_test_ | sandbox.primarycheck.com | Deterministic fake sources, every live source code present, webhooks fire. |
pc_live_ | api.primarycheck.com | Real primary sources. Issued after FCRA customer vetting. |
FCRA gate on every live order
Live verifications are consumer reports. Three checks run before any source is contacted:
403 fcra_not_enabled— the account has not completed customer vetting (§607(a)).403 purpose_not_certified— the account has not certified the requestedpurpose(§604).403 consent_required— no disclosure and authorization proof was attached (§604(b)(2)). Use hosted consent or send your owndisclosureVersion+signedAt.
Rate limits
Every response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset. A 429 includes Retry-After.