Lucror Analytics — Reference

External API User Manual

For detailed API documentation and to test the endpoints interactively, visit the Swagger UI: https://data.sqn.lucroranalytics.com/swagger/index.html

00

Overview & Getting Started

What this API is

The SQN External Data API is a REST API for retrieving SQN credit scores — C-Scores (issuer level) and V-Scores (issue / ISIN level) — either on the latest snapshot date or as a time series over a date range. Authenticate once for a bearer token, then call the data endpoints below.

How to get access

Access is granted per account. Your account must be enabled for external data (claim HasExternalDataAccess) and, per score type, for C-Score and/or V-Score data. To request an account or additional entitlements, contact sqnsupport@lucroranalytics.com.

Glossary

  • C-ScoreSQN modelled market-implied Credit Quality score, on a scale of 0-100.
  • V-ScoreSQN proprietary Value Factor. Positive scores indicate undervaluation; negative scores, overvaluation relative to peers.
  • Inferred C-Score (inferredCScore) — returned as "Y"/"N"; Inferred C-Scores extend SQN quality assessment to issuers without liquid single-name CDS, using synthetic CDS from S&P Global Market Intelligence.
  • Issuer vs Issue — C-Scores are per issuer; V-Scores are per issue, keyed by ISIN.
  • Snapshot date — the date a score set was published; “latest” endpoints return the most recent snapshot with data.
  • Markit short name — the exact issuer identifier accepted by the issuer parameter.
  • ISIN — ISO 6166 12-character security identifier.
01

Authentication using Postman & Swagger

AuthenticateClient Endpoint Documentation

This guide will walk you through the steps to use the AuthenticateClient endpoint using Postman.

Prerequisites

  • Postman installed on your machine. You can download it from here.
  • API base URL. For this guide, we'll assume the base URL is https://data.sqn.lucroranalytics.com

Step-by-Step Guide

Step 1: Open Postman

Open the Postman application on your machine.

Step 2: Create a New Request

  1. Click on the New button in the top left corner.
  2. Select Request from the dropdown menu.

Step 3: Set Up the Request

  1. Set the HTTP method to POST.
  2. Enter the URL for the AuthenticateClient endpoint:
    POST https://data.sqn.lucroranalytics.com/data/authenticate/client

Step 4: Set Up the Headers

  1. Click on the Headers tab.
  2. Add a new header with the following details:
    Key: Content-Type
    Value: application/json

Step 5: Set Up the Body

  1. Click on the Body tab.
  2. Select the raw radio button.
  3. Ensure the format is set to JSON.
  4. Enter the following JSON payload:
    {
      "Username": "email@mail.com",
      "Password": "pass****"
    }

Step 6: Send the Request

Click on the Send button to send the request.

Step 7: View the Response

After sending the request, you should see a response from the server. If the authentication is successful (HTTP 200), you will receive a JSON response containing the authentication token. Example response:

{
  "Username": "email@mail.com",
  "Token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

If the supplied credentials are incorrect, the endpoint returns HTTP 401 Unauthorized; a genuine server-side problem returns HTTP 500 Internal Server Error. Both are returned as a ProblemDetails body (application/problem+json) whose detail field carries the message (“Invalid username or password.” or “Unable to authenticate client.”).

Step 8: Use the Token for Subsequent Requests

Copy the token from the response and use it in the Authorization header for subsequent requests to authenticate your API calls.

  1. Navigate to the Authorization tab in Postman.
  2. Change the type dropdown to Bearer Token.
  3. Paste the token into the Token field.
Key: Authorization
Value: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
02

Data Retrieval Endpoints

Once authenticated, you can use the following GET endpoints to retrieve data. Ensure that the token is included in the Authorization header. Each endpoint has a limit of 10 requests per second.

Issuer Discovery — start here

The issuer parameter on the C-Score and V-Score endpoints is matched exactly, so use this endpoint to find the valid values. Only issuers with scored bonds on the most recent snapshot date are listed — everything it returns is queryable.

List the available issuers

Endpoint: GET /data/issuers?search={search}&correlationId={correlationId}

Parameters:

  • search optional: Case-insensitive substring filter on the issuer short name (format :text). Omit to list every available issuer. Partial matching is supported here — use it to look a name up, then pass the exact value to the score endpoints.
  • correlationId optional: A unique identifier to track requests for troubleshooting.
    eg. {IDENTIFIER_NAME}-{UID} REQ-b5eb8bdf19cd489d89ebf185497b13a9

Description: Returns one row per issuer. The issuer field is the exact value the score endpoints' issuer parameter accepts, so it can be passed straight back. issuerName is the full legal name, for display only — it is not accepted by the issuer parameter.

Sample response (values illustrative):

[
  {
    "issuer": "Pfizer Inc",
    "issuerName": "Pfizer Inc."
  },
  {
    "issuer": "Pepsico Inc",
    "issuerName": "PepsiCo, Inc."
  }
]

This endpoint returns no score data, so it requires only that your account is enabled for C-Score or V-Score data, and it does not consume the distinct-ISIN quota.

C-Score Endpoints

Score access: access to C-Score data is controlled per account. These endpoints require your account to be enabled for C-Score data; if it is not, the request is rejected with 403 Forbidden.

Get the latest C-Score

Endpoint: GET /data/issuer/cscore/latest?issuer={issuerName}&correlationId={correlationId}

Parameters:

  • issuer optional: The issuer's Markit short name, matched exactly (format :text). Partial names are no longer matched and return 404 — use /data/issuers to look up valid values. Omit to return all eligible issuers, subject to the response row limit below.
  • correlationId optional: A unique identifier to track requests for troubleshooting.
    eg. {IDENTIFIER_NAME}-{UID} REQ-b5eb8bdf19cd489d89ebf185497b13a9

Description: Returns C-Score data on the most recent snapshot date that has data — one row per issuer. Omit issuer for all eligible issuers, or supply it to filter to a single issuer.

Sample response (values illustrative):

[
  {
    "date": "2025-04-01",
    "issuerName": "ACME",
    "issuerCScore": 4.20,
    "inferredCScore": "N"
  }
]

Get C-Score over a date range (time series)

Endpoint: GET /data/issuer/cscore/timeseries?issuer={issuerName}&start={startDate}&end={endDate}&correlationId={correlationId}

Parameters:

  • issuer optional: The issuer's Markit short name, matched exactly (format :text). Partial names are no longer matched and return 404 — use /data/issuers to look up valid values. Omit to return all eligible issuers, subject to the response row limit below.
  • start: Range start date (format :date yyyy-MM-dd).
  • end: Range end date (format :date yyyy-MM-dd). Must be on or after start, and the range must not exceed your account's configured limit (1–365 days; 365 by default).
  • correlationId optional: A unique identifier to track requests for troubleshooting.
    eg. {IDENTIFIER_NAME}-{UID} REQ-b5eb8bdf19cd489d89ebf185497b13a9

Description: Returns one row per (issuer, snapshot date) in the supplied range.

Throttle and quota: the global per-IP rate limit of 10 requests/second applies. On the time-series endpoint, the date range may not exceed your account's configured limit (1–365 days; 365 by default). A single response may not exceed 100,000 rows; a request that would return more is rejected with 400, and you should narrow it with the issuer parameter or a shorter date range. Note the row count is driven by how many bonds an issuer has, not by the issuer count — a large issuer over a full year can exceed the limit on its own, while all issuers on a single snapshot date comfortably fit. There is no per-user distinct-issuer quota (unlike the distinct-ISIN quota on the issue endpoints).

V-Score Endpoints

Score access: access to V-Score data is controlled per account. These endpoints require your account to be enabled for V-Score data; if it is not, the request is rejected with 403 Forbidden.

Get the latest V-Score

Endpoint: GET /data/issuer/vscore/latest?issuer={issuerName}&correlationId={correlationId}

Parameters:

  • issuer optional: The issuer's Markit short name, matched exactly (format :text). Partial names are no longer matched and return 404 — use /data/issuers to look up valid values. Omit to return all eligible issuers, subject to the response row limit below.
  • correlationId optional: A unique identifier to track requests for troubleshooting.
    eg. {IDENTIFIER_NAME}-{UID} REQ-b5eb8bdf19cd489d89ebf185497b13a9

Description: Returns V-Score data on the most recent snapshot date that has data — one row per issue (ISIN). Omit issuer for all eligible issuers, or supply it to filter to a single issuer.

Sample response (values illustrative):

[
  {
    "date": "2025-04-01",
    "isin": "US1234567890",
    "issueVScore": 3.10,
    "issueVScoreI": 3.05
  }
]

Get V-Score over a date range (time series)

Endpoint: GET /data/issuer/vscore/timeseries?issuer={issuerName}&start={startDate}&end={endDate}&correlationId={correlationId}

Parameters:

  • issuer optional: The issuer's Markit short name, matched exactly (format :text). Partial names are no longer matched and return 404 — use /data/issuers to look up valid values. Omit to return all eligible issuers, subject to the response row limit below.
  • start: Range start date (format :date yyyy-MM-dd).
  • end: Range end date (format :date yyyy-MM-dd). Must be on or after start, and the range must not exceed your account's configured limit (1–365 days; 365 by default).
  • correlationId optional: A unique identifier to track requests for troubleshooting.
    eg. {IDENTIFIER_NAME}-{UID} REQ-b5eb8bdf19cd489d89ebf185497b13a9

Description: Returns one row per (issue, snapshot date) in the supplied range.

Throttle and quota: the global per-IP rate limit of 10 requests/second applies. On the time-series endpoint, the date range may not exceed your account's configured limit (1–365 days; 365 by default). A single response may not exceed 100,000 rows; a request that would return more is rejected with 400, and you should narrow it with the issuer parameter or a shorter date range. Note the row count is driven by how many bonds an issuer has, not by the issuer count — a large issuer over a full year can exceed the limit on its own, while all issuers on a single snapshot date comfortably fit. There is no per-user distinct-issuer quota (unlike the distinct-ISIN quota on the issue endpoints).

Issue Score Endpoints (by ISIN)

These endpoints take one or more ISINs and return each issue's issuer C-Score and issue V-Scores in a single response. Multiple ISINs may be supplied as a comma-separated list (up to 50 per request). Each response row contains date, isin, issuerName, issuerCScore, inferredCScore (Y/N), issueVScore, and issueVScoreI.

Score access: access to C-Score and V-Score data is controlled per account. The C-Score fields (issuerCScore, inferredCScore) are returned only if your account is enabled for C-Score data, and the V-Score fields (issueVScore, issueVScoreI) only if your account is enabled for V-Score data. If your account is enabled for only one, the fields you are not entitled to are returned as null. If your account is enabled for neither, the request is rejected with 403 Forbidden.

Get Issue Scores over a date range (time series)

Endpoint: GET /data/issue/scores/timeseries?isin={isin}&start={startDate}&end={endDate}&correlationId={correlationId}

Parameters:

  • isin: One or more 12-character ISO 6166 ISINs, comma-separated, up to 50 per request (format :text). e.g. US1234567890,US0987654321.
  • start: Range start date (format :date yyyy-MM-dd).
  • end: Range end date (format :date yyyy-MM-dd). Must be on or after start, and the range must not exceed your account's configured limit (1–365 days; 365 by default).
  • correlationId optional: A unique identifier to track requests for troubleshooting.
    eg. {IDENTIFIER_NAME}-{UID} REQ-b5eb8bdf19cd489d89ebf185497b13a9

Description: Returns one row per (ISIN, snapshot date) in the supplied range, each containing the issuer C-Score and issue V-Scores.

Get the latest Issue Scores

Endpoint: GET /data/issue/scores/latest?isin={isin}&correlationId={correlationId}

Parameters:

  • isin: One or more 12-character ISO 6166 ISINs, comma-separated, up to 50 per request (format :text). e.g. US1234567890,US0987654321.
  • correlationId optional: A unique identifier to track requests for troubleshooting.
    eg. {IDENTIFIER_NAME}-{UID} REQ-b5eb8bdf19cd489d89ebf185497b13a9

Description: Returns the issue scores on the most recent snapshot date that has data across the requested ISINs — one row per ISIN that has data on that date. ISINs with no data on the latest snapshot date are omitted, and an empty array is returned if none of the requested ISINs have data.

Throttle and quota: in addition to the global per-IP rate limit (10 requests/second), the issue endpoints enforce a per-user cap of 2,000 distinct ISINs queried within a rolling 1-year window. Re-querying an ISIN already counted in that window does not consume additional quota; each new ISIN in a request counts once. A maximum of 50 ISINs may be supplied per request, and the time-series date range may not exceed your account's configured limit (1–365 days; 365 by default).

03

Additional Information

Correlation IDs

These are essential for tracking individual requests through the system for debugging and tracing purposes. Always provide a correlationId if available, as it makes it easier to find and track logs if issues arise.

Date Format

For all endpoints that require date parameters, use the yyyy-MM-dd format.

Authentication

Authentication is bearer-token only. Send the JWT from /data/authenticate/client in the Authorization: Bearer <token> header on every data request. Cookies are not used. If the token is missing or invalid, the endpoint returns 401 with a ProblemDetails body.

Error Handling

Every error is returned as an RFC 9457 ProblemDetails body with content type application/problem+json. The human-readable message is in the detail field, alongside status, title, and a traceId. Example:

{
  "type": "https://tools.ietf.org/html/rfc9110#section-15.5.4",
  "title": "Not Found",
  "status": 404,
  "detail": "No issuer found matching 'NOPE'. Check the Markit short name and retry.",
  "traceId": "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01"
}
  • 400 Bad Request: A problem with the request parameters — e.g. the result set exceeds the 100,000 row limit on the C-Score / V-Score endpoints (narrow it with issuer or a shorter date range); invalid ISIN format or more than 50 ISINs on the issue endpoints; end date before start date; or a date range exceeding your account's configured limit.
  • 401 Unauthorized: On /data/authenticate/client, the supplied username or password is incorrect. On data endpoints, the bearer token is missing or invalid.
  • 403 Forbidden: Your account is not enabled for the data API; or, on the C-Score endpoints, your account is not enabled for C-Score data; or, on the V-Score endpoints, your account is not enabled for V-Score data; or, on the issue endpoints, your account is enabled for neither C-Score nor V-Score data. (On the issue endpoints, if enabled for only one, the request returns 200 with the score fields you lack set to null.)
  • 404 Not Found: On the C-Score / V-Score endpoints, the supplied issuer short name did not match exactly. Matching is now exact — a partial or substring name that previously returned results now returns 404, and the detail field names the offending value. Use /data/issuers?search= to find the exact short name.
  • 429 Too Many Requests: The caller exceeded the per-IP rate limit (10 req/sec) or, on the issue endpoints, the per-user distinct-ISIN quota (2,000 distinct ISINs per rolling 1-year window). The response includes a Retry-After header (in seconds).
  • 500 Internal Server Error: A general server-side error (including upstream auth-service failures on /data/authenticate/client). This will be logged with details if it occurs.

Logging and Monitoring

The system logs all requests and responses along with any issues encountered. This helps with debugging if anything unexpected happens.