Certigence Data API

Read-only programmatic access to ESG company data, ratings, and search. Authenticate with a `cer_...` API key provisioned from your Certigence dashboard. API keys and outbound webhooks require a Professional or Enterprise subscription. Rate limits per key: 100 requests per 15 minutes on Professional, 1,000 on Enterprise; exceeding them returns HTTP 429. There are no write endpoints.

Authentication

Create an API key in your Certigence dashboard and send it as Authorization: Bearer cer_... or in the X-API-Key header. Keys are tied to your company and require a Professional or Enterprise subscription; other plans receive HTTP 403.

Rate limits

  • Professional: 100 requests per 15 minutes per API key.
  • Enterprise: 1,000 requests per 15 minutes per API key.
  • Requests over the limit receive HTTP 429.

Endpoints

  • GET /api/v1/companies — List companies with scores
  • GET /api/v1/companies/{id} — Get a single company
  • GET /api/v1/companies/{id}/score — Get the current ESG score for a company
  • GET /api/v1/companies/{id}/controversies — Structured ESG controversies
  • GET /api/v1/companies/{id}/score/history — Historical ESG score snapshots
  • GET /api/v1/rankings/{sector} — Sector-level ranking for portfolio screening
  • GET /api/v1/search — Search companies by name

Webhooks

Outbound webhooks are signed with HMAC-SHA256 using the secret shown once at endpoint creation. The signature is delivered in the `X-Webhook-Signature` header. Verify by computing `hmac_sha256(secret, raw_body)` and comparing in constant time. Event types: company.created, company.updated, company.score_changed, alert.triggered, goal.achieved, goal.at_risk, deadline.upcoming, deadline.overdue, task.completed, action_plan.completed, verification.completed, payment.succeeded, payment.failed.

What the API does not do

  • There are no write endpoints; data is entered in the app or through the supplier portal.
  • There are no official SDKs; any HTTP client works with the OpenAPI spec.