Finder API terms

In short. Check items that are genuinely in front of you, keep your keys secret, don't treat a result as proof of ownership, and never use the API to build a database or track people. If you check an item that's been reported lost or stolen, its owner will be told your company checked it.

These terms apply to your use of the Regimate Finder API, the developer portal and webhooks, in addition to our Business terms and Acceptable use policy. Technical details are in the API documentation.

1. Getting access

Any Regimate account with a verified email address can create a Finder API account from the developer portal. You can start on the free Sandbox plan and upgrade at any time. The person who creates the account confirms they're acting for the business named on it.

2. API keys

• Keys look like rmf_<id>.<secret>. The secret is shown once and we store only a hash of it, so we can't show it to you again.
• Use keys only from your servers. Never put them in client-side code, mobile apps or version control.
• You're responsible for all use of your keys. Revoke a key straight away from the portal if you think it's been exposed, and tell us at security@regimate.app.
• Keys can be set to expire. All your keys share your Plan's limits.

3. Permitted use

You may use the Finder API to check whether a specific item has been registered and whether it has been reported lost or stolen, as part of a legitimate business process, for example when you:

• buy, sell, list, pawn or take an item in part exchange;
• repair, refurbish or recycle an item;
• assess an insurance claim;
• handle lost property, or support police or public safety work.

Each lookup should relate to an item you're actually handling, have been offered, or have been asked to check. Use the partnerRef parameter for your own reference, such as an order or job number, but don't put personal information in it.

4. What you mustn't do

• Enumerate, scan or bulk-check identifiers, or use the API to copy, cache or rebuild any part of the registry.
• Use results to identify, locate, profile or contact a person, other than through the contact link we provide.
• Resell, republish or share results with third parties, except as needed for the transaction you made the lookup for or where the law requires it.
• Get around rate limits, quotas or plan restrictions, including by using more than one account.
• Use the API in a way that harms Regimate, its users or the people whose items are in the registry.

5. Understanding results

• A result tells you whether an item is registered, its status (for example lost or stolen), its category and the month it was registered. For lost or stolen items it also includes a link to the item's public page, where you can message the owner anonymously. Results never include the owner's identity or contact details.
• The registry contains only what owners have registered. “Not registered” or “safe” doesn't mean an item isn't stolen, and a registration isn't proof of legal ownership. Use results as one input alongside your own checks.
• If an item comes back as lost or stolen, don't confront or accuse the person presenting it. Follow your own procedures and, where appropriate, contact the police or message the owner through the contact link.

6. Owner alerts

When you look up an item that's been reported lost or stolen, we tell its owner (or, for organisation assets, the organisation's admins) by email and push notification that it was just checked, and we name the company on your Finder API account. By using the API you agree to us sharing your company name in this way. We don't share your partnerRef or your staff's details.

7. Webhooks

• If you register a webhook endpoint, we'll send an item.status_changed event when an item you looked up in the last 90 days changes status.
• Endpoints must use HTTPS on port 443 or 8443 and resolve to public addresses. We don't follow redirects and time out after 10 seconds.
• Every delivery is signed in the X-Regimate-Signature header. Verify the signature and timestamp before trusting a payload.
• Failed deliveries are retried up to five times over about ten hours.

8. Plans, limits and fees

Each Plan has a monthly lookup allowance, a daily cap and a per-minute rate limit, shared across all your keys. When you hit a limit the API returns an error such as RATE_LIMIT_EXCEEDED with a Retry-After header, DAILY_CAP_EXCEEDED or MONTHLY_LIMIT_EXCEEDED. The free Sandbox stops at its limits and is never charged. On paid plans, lookups beyond your allowance are charged at your Plan's per-lookup rate. Prices are on our Pricing page, and billing works as described in our Business terms.

9. Data protection

We don't process personal data on your behalf when we answer a lookup, so each of us is responsible for its own compliance with data protection law. We log a SHA-256 hash of each query, your partnerRef, the result and the time, so we can bill you, enforce limits and investigate misuse. We never store the identifier you looked up in plain form.

10. Changes to the API

We version the API (currently v1). We'll give you at least 90 days' notice before making breaking changes to a published version, unless a faster change is needed for security or legal reasons. We may add fields and endpoints at any time, so build your integration to ignore fields it doesn't recognise. Service status is published at my.regimate.app/developers/status.

11. Using our name

You may say that you check items against the Regimate registry. Please ask us before using our logo, and don't suggest that we endorse you or that a Regimate result guarantees anything.

12. Suspension and termination

We may throttle, suspend or revoke access if your use breaches these terms, puts the registry or its users at risk, or if payment is overdue. You can stop using the API and close your Finder API account at any time from the developer portal; any outstanding usage is billed first.

13. Contact

Technical support: support@regimate.app
Plans and pricing: sales@regimate.app