Government — entry 031 of 90
Food Standards Agency
The Food Hygiene Rating Scheme API returns FHRS/FHIS inspection ratings for food businesses across the UK, filterable by local authority, name, and location. A live keyless query against `api.ratings.food.gov.uk/Establishments` (with the mandatory `x-api-version: 2` header) returned real establishment JSON with a wildcard `Access-Control-Allow-Origin` header. The stored `/open-data/en-GB` path now 404s after the host moved fully to HTTPS; the API itself needs no key, only the version header.
The Food Standards Agency's ratings API returns official UK food hygiene inspection results — business name, address, rating value, inspection date, and the responsible local authority — across all four UK countries (`GET /Countries` returns England, Northern Ireland, Scotland, and Wales). It covers two parallel schemes: the 0–5 Food Hygiene Rating Scheme (FHRS) in England, Wales, and Northern Ireland, and the pass/improvement-required Food Hygiene Information System (FHIS) in Scotland. It's a keyless REST API, but every call must carry a mandatory version header or the gateway rejects it outright.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/food-standards-agency/"><img src="https://greatapis.com/badge/food-standards-agency.svg" alt="Scored 94 on greatapis.com"></a>Auth quickstart
- No API key required — requests are public and keyless. Every request must instead include an `x-api-version: 2` header; omit it and the API returns a 404 as if the resource doesn't exist at all, confirmed live on 2026-07-26 (`GET /Establishments` with no version header → `404 "The API 'Establishments' doesn't exist"`).
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Search establishments by name and local authority
GEThttps://api.ratings.food.gov.uk/Establishments?name=Nando%27s&localAuthorityId=197&pageSize=1
x-api-version: 2
{
"establishments": [
{
"BusinessName": "NANDO'S",
"BusinessType": "Restaurant/Cafe/Canteen",
"BusinessTypeID": 1,
"FHRSID": 592604,
"LocalAuthorityCode": "760",
"LocalAuthorityName": "Aberdeen City",
"PostCode": "AB10 1LB",
"RatingDate": "2024-03-05T00:00:00",
"RatingKey": "fhis_pass_en-gb",
"RatingValue": "Pass",
"SchemeType": "FHIS",
"geocode": { "longitude": "-2.10103", "latitude": "57.147518" },
"scores": { "Hygiene": null, "Structural": null, "ConfidenceInManagement": null }
}
],
"meta": {
"dataSource": "ElasticSearch",
"totalCount": 2,
"totalPages": 2,
"pageSize": 1,
"pageNumber": 1
}
}Developer reference
https://api.ratings.food.gov.ukGotchas & limits
- The version header is genuinely mandatory, not optional metadata — a live 2026-07-26 probe confirmed the API returns 404 without it, as though the endpoint doesn't exist, rather than a 400 or a helpful error naming the missing header.
- Unfiltered list queries are rejected even with the version header present: `GET /Establishments` with only `x-api-version: 2` and no other filter returned a live `403 {"Message":"This is a CPU intensive query: please use one of the documented filters in your query (e.g. filter by LocalAuthority)."}` — always pass at least one of `name`, `localAuthorityId`, `businessTypeId`, or a geographic filter.
- `SchemeType` isn't always `"FHRS"` — Scottish authorities run the parallel `FHIS` scheme, which is why the Aberdeen City example above comes back `"SchemeType": "FHIS"` with `"RatingValue": "Pass"` instead of a 0–5 number. Confirmed live on 2026-07-26 against the API's own metadata: `GET /SchemeTypes` maps id 1 to FHRS and id 2 to FHIS, and in `GET /Authorities/basic` every Scottish authority checked (Aberdeen City, Glasgow City, Edinburgh, Highland, Fife) is `SchemeType: 2` while Northern Irish ones (Belfast City, Derry City and Strabane, Mid Ulster) are `SchemeType: 1` — Northern Ireland is FHRS, not FHIS.
- The `scores` breakdown is populated for FHRS records but all-null for FHIS ones — confirmed live on 2026-07-26: an English FHRS record returned `"RatingValue": "5"` with `{"Hygiene": 5, "Structural": 5, "ConfidenceInManagement": 5}`, while the Scottish FHIS record above returned `"Pass"` with all three sub-scores `null`. Don't assume a numeric rating or a usable score breakdown without checking `SchemeType` first.
- CORS is wide open — `Access-Control-Allow-Origin: *` on every response, with `Access-Control-Allow-Methods: GET, POST` and `Access-Control-Allow-Headers: Authorization, ApiKey, X-Api-Version` (the API advertising the very version header it requires), so browser calls work without a proxy. The documented public endpoints are GET-only for reads.