generated: '2026-07-25'
method: searched
source: >-
  https://www.fca.org.uk/firms/financial-services-register ; live anonymous probes
  of https://register.fca.org.uk/services/V0.1/* and https://api.data.fca.org.uk/* ;
  https://register.fca.org.uk/.well-known/openid-configuration ;
  https://www.fca.org.uk/publication/systems-information/fca-firds-tech-spec.pdf
note: >-
  The FCA publishes no OpenAPI, so this profile is assembled from the FCA's own
  public pages and technical specifications plus live anonymous probes, not
  derived from securitySchemes. Two different auth models operate on two
  different FCA API surfaces, and a third (OIDC) belongs to the portal only.
summary:
  types: [apiKey, none]
  api_key_in: [header]
  oauth2_flows: []
  openapi_derived: false
schemes:
- name: FSRegisterHeaderAuth
  type: apiKey
  in: header
  api: FCA Financial Services Register API
  base_url: https://register.fca.org.uk/services/V0.1
  parameters:
  - name: X-Auth-Email
    description: The email address the developer registered with on the FS Register developer portal.
  - name: X-Auth-Key
    description: The API key generated from the developer portal profile.
  obtained_via: >-
    Free self-serve registration at https://register.fca.org.uk/Developer/s/ (a
    Salesforce Experience Cloud login wall with a "Register to be a New User"
    path). The key is generated from the registration profile.
  cost: free
  evidence:
  - kind: live probe
    request: GET https://register.fca.org.uk/services/V0.1/Firm/122702
    status: 403
    body: '{"Success":"false", "Sorry, this page is not available. Missing Headers."}'
    note: The API rejects the anonymous request for missing auth headers rather than 404ing the route.
  - kind: third-party client documentation
    url: https://financial-services-register-api.readthedocs.io/en/latest/sources/usage.html
    note: >-
      Community Python client shows the prepared request headers
      {'Accept': 'application/json', 'X-Auth-Email': ..., 'X-Auth-Key': ...}.
      The FCA's own reference documentation for these headers sits behind the
      portal login and is not anonymously verifiable.
- name: DataPublicationAnonymous
  type: none
  api: FCA Data Publication API (FIRDS / FITRS file query)
  base_url: https://api.data.fca.org.uk
  description: >-
    The documented machine-to-machine file-listing interface behind
    data.fca.org.uk requires no credentials. Only the two documented indices
    respond anonymously.
  evidence:
  - kind: live probe
    request: GET https://api.data.fca.org.uk/fca_data_firds_files?q=*&size=1
    status: 200
  - kind: live probe
    request: GET https://api.data.fca.org.uk/fca_data_fitrs_files?q=*&size=1
    status: 200
  - kind: live probe
    request: GET https://api.data.fca.org.uk/fca_data_ssr_current?q=*&size=1
    status: 403
    body: Missing Authentication Token
    note: >-
      Undocumented sibling index names all return 403; only the two indices the
      FCA documents in its published technical specifications are public.
portal_identity:
  protocol: openid-connect
  scope: developer portal login only — NOT the Register API
  discovery: https://register.fca.org.uk/.well-known/openid-configuration
  captured: well-known/fca-uk-openid-configuration.json
  issuer: https://register.fca.org.uk
  authorization_endpoint: https://register.fca.org.uk/services/oauth2/authorize
  token_endpoint: https://register.fca.org.uk/services/oauth2/token
  note: >-
    Served by the Salesforce Experience Cloud platform hosting the Register site.
    The scopes_supported list is the stock Salesforce platform set (cdp_api,
    wave_api, pardot_api, chatter_api, mcp_api, ...) and does not describe any
    FCA API permission model, which is why no scopes/ artifact is emitted.
not_present:
  mutual_tls: false
  oauth2_for_apis: false
  scopes: >-
    No scope model exists on either FCA API surface — the Register API is a flat
    header key with full read access, the data publication API is anonymous.