Government — entry 031 of 90
Food Standards Agency
The Food Hygiene Rating Scheme API returns FHRS/FHIS inspection ratings for food businesses across the UK, filterable by local authority, name, and location. A live keyless query against `api.ratings.food.gov.uk/Establishments` (with the mandatory `x-api-version: 2` header) returned real establishment JSON with a wildcard `Access-Control-Allow-Origin` header. The stored `/open-data/en-GB` path now 404s after the host moved fully to HTTPS; the API itself needs no key, only the version header.
The Food Standards Agency's ratings API returns official UK food hygiene inspection results — business name, address, rating value, inspection date, and the responsible local authority — across all four UK countries (GET /Countries returns England, Northern Ireland, Scotland, and Wales). It covers two parallel schemes: the 0–5 Food Hygiene Rating Scheme (FHRS) in England, Wales, and Northern Ireland, and the pass/improvement-required Food Hygiene Information System (FHIS) in Scotland. It's a keyless REST API, but every call must carry a mandatory version header or the gateway rejects it outright.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/food-standards-agency/"><img src="https://greatapis.com/badge/food-standards-agency.svg" alt="Scored 94 on greatapis.com"></a>Auth quickstart
- No API key required — requests are public and keyless. Every request must instead include an
x-api-version: 2header; omit it and the API returns a 404 as if the resource doesn't exist at all, confirmed live on 2026-07-26 (GET /Establishmentswith no version header →404 "The API 'Establishments' doesn't exist").
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Search establishments by name and local authority
GEThttps://api.ratings.food.gov.uk/Establishments?name=Nando%27s&localAuthorityId=197&pageSize=1
x-api-version: 2
{
"establishments": [
{
"BusinessName": "NANDO'S",
"BusinessType": "Restaurant/Cafe/Canteen",
"BusinessTypeID": 1,
"FHRSID": 592604,
"LocalAuthorityCode": "760",
"LocalAuthorityName": "Aberdeen City",
"PostCode": "AB10 1LB",
"RatingDate": "2024-03-05T00:00:00",
"RatingKey": "fhis_pass_en-gb",
"RatingValue": "Pass",
"SchemeType": "FHIS",
"geocode": { "longitude": "-2.10103", "latitude": "57.147518" },
"scores": { "Hygiene": null, "Structural": null, "ConfidenceInManagement": null }
}
],
"meta": {
"dataSource": "ElasticSearch",
"totalCount": 2,
"totalPages": 2,
"pageSize": 1,
"pageNumber": 1
}
}Developer reference
https://api.ratings.food.gov.ukAn absolute per-client-IP limit (undisclosed exact threshold, HTTP 403 when exceeded); page sizes above 200 additionally trigger rate limiting (HTTP 429)
Gotchas & limits
- The version header is genuinely mandatory, not optional metadata — a live 2026-07-26 probe confirmed the API returns 404 without it, as though the endpoint doesn't exist, rather than a 400 or a helpful error naming the missing header.
- Unfiltered list queries are rejected even with the version header present:
GET /Establishmentswith onlyx-api-version: 2and no other filter returned a live403 {"Message":"This is a CPU intensive query: please use one of the documented filters in your query (e.g. filter by LocalAuthority)."}— always pass at least one ofname,localAuthorityId,businessTypeId, or a geographic filter. SchemeTypeisn't always"FHRS"— Scottish authorities run the parallelFHISscheme, which is why the Aberdeen City example above comes back"SchemeType": "FHIS"with"RatingValue": "Pass"instead of a 0–5 number. Confirmed live on 2026-07-26 against the API's own metadata:GET /SchemeTypesmaps id 1 to FHRS and id 2 to FHIS, and inGET /Authorities/basicevery Scottish authority checked (Aberdeen City, Glasgow City, Edinburgh, Highland, Fife) isSchemeType: 2while Northern Irish ones (Belfast City, Derry City and Strabane, Mid Ulster) areSchemeType: 1— Northern Ireland is FHRS, not FHIS.- The
scoresbreakdown is populated for FHRS records but all-null for FHIS ones — confirmed live on 2026-07-26: an English FHRS record returned"RatingValue": "5"with{"Hygiene": 5, "Structural": 5, "ConfidenceInManagement": 5}, while the Scottish FHIS record above returned"Pass"with all three sub-scoresnull. Don't assume a numeric rating or a usable score breakdown without checkingSchemeTypefirst. - CORS is wide open —
Access-Control-Allow-Origin: *on every response, withAccess-Control-Allow-Methods: GET, POSTandAccess-Control-Allow-Headers: Authorization, ApiKey, X-Api-Version(the API advertising the very version header it requires), so browser calls work without a proxy. The documented public endpoints are GET-only for reads.