# Experian

> Experian plc is a global information services company and one of the three major consumer credit
> bureaus, operating across credit risk, identity verification, fraud prevention, marketing data and
> data quality. Its public API surface spans two distinct platforms with very different postures.

Generated by API Evangelist on 2026-09-13 from the artifacts in this repository. Experian publishes
no llms.txt of its own on any host probed (experian.com, developer.experian.com,
docs.experianaperture.io, api.experianaperture.io — all 404).

## The two platforms

**Experian Data Quality / Aperture** (api.experianaperture.io) is the machine-readable half. Eleven
OpenAPI 3.0.4 documents are published openly at api.experianaperture.io/docs/, covering 41 operations
across 34 paths: address search/validate/format/layouts, email validation, phone validation,
demographic enrichment, identity append, reverse phone append, and an asynchronous bulk batch surface
for all three data types. Authentication is an `Auth-Token` header issued from the Self Service
Portal, with an OAuth2 client-credentials flow also declared. There is no sandbox — you call
production with a licensed token.

**Experian Global Developer Platform** (developer.experian.com) fronts the credit, business
information, KYC/KYB and decisioning products. It is region-partitioned — the United States, United
Kingdom, EMEA, Brazil, India, Singapore and Australia each run their own production and sandbox hosts
with their own OAuth2/OIDC issuer. It publishes no OpenAPI; product API reference sits behind a
Developer Portal account, and its OAuth2 password-grant sandbox is self-service after email
verification.

## APIs

- [Experian Aperture Data Quality API](https://docs.experianaperture.io/): the consolidated 41-operation REST surface. Base: https://api.experianaperture.io
- [Experian Address Validation](https://docs.experianaperture.io/address-validation/experian-address-validation/): autocomplete, typedown, single-line, lookup and validate search across 245+ countries, with custom layouts and what3words reverse geocoding
- [Experian Email Validation](https://docs.experianaperture.io/email-validation/experian-email-validation-v2): deliverability confidence classification. v1 reaches End of Service Life 2026-04-30
- [Experian Phone Validation](https://docs.experianaperture.io/phone-validation/experian-phone-validation): validity, line type, portability, PLUS_E164 formatting
- [Experian Enrichment](https://docs.experianaperture.io/data-resources/global-datasets/): geocodes, Global Location Insight, Mosaic geodemographic segmentation
- [Experian Identity Append](https://docs.experianaperture.io/identity-append/experian-identity-append/): identity and contact attribute append. USA only
- [Experian Bulk Validation](https://docs.experianaperture.io/address-validation/experian-address-validation/bulk-api-reference/api-specification/): asynchronous batches, up to 10,000 addresses per call
- [Experian Address Validate SOAP (Pro OnDemand V3)](https://docs.experianaperture.io/address-validation/address-validate-soap/): the legacy QAS SOAP contract, still published and callable. 11 RPCs. Base: https://ws.ondemand.qas.com/ProOnDemand/V3/ProOnDemandService.asmx
- [Experian Global Developer Platform](https://developer.experian.com/products): credit, business information, KYC/KYB, decisioning. No public contract

## Specifications

- OpenAPI 3.0.4 (consolidated): https://api.experianaperture.io/docs/openapi.json
- OpenAPI per product: https://api.experianaperture.io/docs/{addressvalidation,emailvalidationv2,phonevalidation,enrichment,identityappend,reversephoneappend,bulkaddress,bulkemail,bulkphone,emailvalidation}.json
- WSDL 1.1: https://ws.ondemand.qas.com/ProOnDemand/V3/ProOnDemandService.asmx?WSDL
- Hosted Swagger console (browse only, try-it-out disabled): https://api.experianaperture.io/docs
- No AsyncAPI, no GraphQL, no gRPC/Protobuf, no MCP server, no A2A agent card

## Authentication

- Aperture: `Auth-Token` header (or `x-app-key`), issued per integration from the Self Service Portal. Per-integration domain and IP allowlists apply — a valid token from an unlisted domain or IP returns 403. An OAuth2 clientCredentials flow against https://sso.experianaperture.io is also declared in the spec.
- Global Developer Platform: OAuth2 password grant against the regional host, e.g. POST https://sandbox-us-api.experian.com/oauth2/v1/token, returning a Bearer access token and a refresh token.
- OIDC discovery is served on ten hosts: https://sso.experianaperture.io/.well-known/openid-configuration plus the US, UK, EU, IN, AU and SG production and sandbox hosts.
- Detail: authentication/experian-authentication.yml

## Runtime semantics an agent needs

- **Rate limit: 150 requests per minute, enforced per ACCOUNT** and shared across every license, integration and token. It cannot be raised. Headers: `X-Rate-Limit-Limit`, `X-Rate-Limit-Remaining`, `X-Rate-Limit-Reset` (UTC epoch). Status on exhaustion: 429. There is no `Retry-After`.
- **Errors** are an `error` object with `type`, `title`, `detail`, `instance` — the RFC 9457 member set, but served as `application/json`, not `application/problem+json`, and with no `status` member. Documented codes: 400, 401, 403, 404, 406, 408, 415, 429, 500, 503.
- **No idempotency.** No `Idempotency-Key`, no deduplication. `Reference-ID` is a correlation header for support, not replay protection. A retried batch create can create a second billable batch.
- **No pagination.** Collection endpoints return whole collections.
- **Timeouts** are caller-specified, valid range 3–15 seconds; outside that you get a 400.
- **Versioning** is a path segment (/v1, /v2, /v3). Multiple majors run concurrently.
- **Reversibility**: bulk batches can be stopped (`POST /{type}/bulk/v1/batches/{batch_id}/stop`) but no window is stated. Deleting a custom address layout (`DELETE /address/layouts/v2/{name}`) is irreversible — no restore is documented.
- **Billing**: one credit per request returning HTTP 200 with metadata status S200 or S206. Everything else is free.

## Operational

- Status page: https://status.edq.com/ (incident feed https://status.edq.com/history.atom)
- SLA: 99.99% for Address/Email/Phone Validation, 99.95% for other services. P1 resolution target 2 working hours, P2 6 working hours, P3 7 business days. 21 days minimum notice for planned maintenance. https://docs.experianaperture.io/saas-services-sla
- End of Service Life policy and dated retirement table for 60+ products: https://docs.experianaperture.io/end-of-service-life-status
- Release notes (dated prose, per product, no feed): https://docs.experianaperture.io/address-validation/experian-address-validation/help/release-notes/
- Roadmap (dated, three-lane, refreshed August 2026): https://docs.experianaperture.io/more/product-roadmap/
- Vulnerability disclosure: https://hackerone.com/experian (private program, public policy; 5-day first response and triage targets). No security.txt is served on any Experian host.

## SDKs and components

- @experian-ecs/connected-web-sdk (npm, 2.5.2, 2026-08-14) — Embedded Experiences web SDK
- @experian-ecs/connected-api-sdk (npm, 1.7.0, 2026-04-22)
- edq-data-validation-sdks (.NET, Java, TypeScript) — https://github.com/experianplc/edq-data-validation-sdks — GitHub source only; the TypeScript manifest names "@experianplc/edq.dvs.sdk" but that name 404s on npm. Clone and build; you cannot install it.
- Experian.Api.Client (NuGet, 2.0.0-build001, 2018-11-02) — first-party .NET client for Business Information Services, unreleased since 2018
- Platform connectors: Shopify, BigCommerce, Salesforce (Sales/Service and Commerce Cloud), Microsoft Dynamics 365 / Power Platform, SAP S/4HANA, Snowflake

## Access

- Developer Portal signup: https://developer.experian.com/sso/register
- Data Quality free trial: https://docs.experianaperture.io/free-trials/data-validation/
- Pricing: not published. Credit-based, negotiated with an account manager. The billing unit is public; the price is not.
- Support: https://community.experianaperture.io/ and https://docs.experianaperture.io/global-support-policy/

## Regulatory note

Experian is a consumer reporting agency. Its identity append, reverse phone append and enrichment
operations return personal data about identifiable people, and in the United States their use is
governed by the FCRA and GLBA — permissible purpose is a legal test. An agent that cannot name its
permissible purpose should not call those operations.

## Repository artifacts

- openapi/ — 11 verbatim OpenAPI 3.0.4 documents
- wsdl/ — the verbatim Pro OnDemand V3 WSDL
- well-known/ — 12 OIDC/OAuth discovery documents saved verbatim, plus the full probe record
- authentication/, scopes/, security/, conformance/, conventions/, errors/, lifecycle/, changelog/
- data-model/, components/, packages/, sandbox/, plans/, rate-limits/, mcp/, overlays/, skills/