I just clicked on an api.equifax.com link in a text message

It was subsequently acquired by Realpage. (also a legitimate company) Surprised to hear anything is still running at the On-Site domain name, but checking the WHOIS shows that the domain is pointing at RealPage servers, so it seemingly hasn’t been squatted on.

If it was legitimately the On-Site.com domain I think you’re fine. More likely just a kludgy bug.

If you have a link to the form, I can pass it along to the On-Site folks to verify.

The link is legitimate, but can't say the source from which it was generated. These kind of links can be generated by 3rd parties too.

The only question I have is: did they ask you for permission or notify that they were going to do so?

Equifax is the third largest credit agency, and I’m sure the rental site partners with them.

Nothing to worry about.

Unless you think the idea is that are going to clone you, pod people style. Nobody can steal your identity, what they seek to do is defraud a bank or credit institution, you aren't really involved besides them incidentally using your name to do so. I wouldn't worry about it unless you get a bill or have something wrong on your credit report.