diff --git a/src/main/java/com/qubiton/sdk/QubitOnClient.java b/src/main/java/com/qubiton/sdk/QubitOnClient.java
index ed66738..539a0fa 100644
--- a/src/main/java/com/qubiton/sdk/QubitOnClient.java
+++ b/src/main/java/com/qubiton/sdk/QubitOnClient.java
@@ -1008,10 +1008,29 @@ private static String requireCountryIso2(Tax.TaxRequest r) {
     }
 
     @Override public Esg.ESGResponse lookupESGScore(Esg.ESGRequest r) {
-        return executeSync("POST", "/api/esg/Scores", r, Esg.ESGResponse.class);
+        return executeSync("POST", esgPath(r), r, Esg.ESGResponse.class);
     }
     @Override public CompletableFuture<Esg.ESGResponse> lookupESGScoreAsync(Esg.ESGRequest r) {
-        return executeAsync("POST", "/api/esg/Scores", r, Esg.ESGResponse.class);
+        return executeAsync("POST", esgPath(r), r, Esg.ESGResponse.class);
+    }
+
+    /**
+     * Build the ESG endpoint path with country and domain as query-string
+     * parameters. Server binds them as {@code [FromQuery]} on ESGController,
+     * not body — they are {@code @JsonIgnore} on {@link Esg.ESGRequest} so
+     * Jackson naturally omits them from the marshalled body.
+     */
+    private static String esgPath(Esg.ESGRequest r) {
+        if (r == null) return "/api/esg/Scores";
+        StringBuilder qs = new StringBuilder();
+        if (r.getCountry() != null && !r.getCountry().isEmpty()) {
+            qs.append("country=").append(java.net.URLEncoder.encode(r.getCountry(), java.nio.charset.StandardCharsets.UTF_8));
+        }
+        if (r.getDomain() != null && !r.getDomain().isEmpty()) {
+            if (qs.length() > 0) qs.append('&');
+            qs.append("domain=").append(java.net.URLEncoder.encode(r.getDomain(), java.nio.charset.StandardCharsets.UTF_8));
+        }
+        return qs.length() == 0 ? "/api/esg/Scores" : "/api/esg/Scores?" + qs;
     }
 
     @Override public Security.DomainSecurityResponse domainSecurityReport(Security.DomainSecurityRequest r) {
diff --git a/src/main/java/com/qubiton/sdk/models/Esg.java b/src/main/java/com/qubiton/sdk/models/Esg.java
index 9f976d0..fadabc5 100644
--- a/src/main/java/com/qubiton/sdk/models/Esg.java
+++ b/src/main/java/com/qubiton/sdk/models/Esg.java
@@ -1,5 +1,6 @@
 package com.qubiton.sdk.models;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
@@ -10,11 +11,22 @@
 public final class Esg {
     private Esg() {}
 
+    /**
+     * Request shape for {@code lookupESGScore}.
+     *
+     * <p>The body sent on the wire contains only {@code companyName}. {@code country} and
+     * {@code domain} are bound on the server as {@code [FromQuery]} parameters on
+     * ESGController — the SDK serialises them into the URL query string and excludes
+     * them from the JSON body via {@code @JsonIgnore}. Sending them in the body would
+     * silently no-op.
+     */
     @JsonInclude(JsonInclude.Include.NON_NULL)
     public static final class ESGRequest {
         @JsonProperty("companyName") private String companyName;
-        @JsonProperty("country") private String country;
-        @JsonProperty("domain") private String domain;
+        /** Sent as URL query parameter {@code ?country=…}, NOT body. */
+        @JsonIgnore private String country;
+        /** Sent as URL query parameter {@code &domain=…}, NOT body. */
+        @JsonIgnore private String domain;
 
         public String getCompanyName() { return companyName; }
         public ESGRequest setCompanyName(String v) { this.companyName = v; return this; }
diff --git a/src/main/java/com/qubiton/sdk/models/Risk.java b/src/main/java/com/qubiton/sdk/models/Risk.java
index a669d24..5167944 100644
--- a/src/main/java/com/qubiton/sdk/models/Risk.java
+++ b/src/main/java/com/qubiton/sdk/models/Risk.java
@@ -344,7 +344,11 @@ public static final class FailRateResponse {
     @JsonInclude(JsonInclude.Include.NON_NULL)
     public static final class EntityRiskRequest {
         @JsonProperty("companyName") private String companyName;
-        @JsonProperty("countryOfIncorporation") private String countryOfIncorporation;
+        // Wire field is "CountryOfIncorporation" (PascalCase) — pinned by
+        // [JsonPropertyName("CountryOfIncorporation")] on the canonical API DTO,
+        // which overrides the global camelCase naming policy. The server is
+        // case-sensitive here, so the lowercase alias is silently dropped.
+        @JsonProperty("CountryOfIncorporation") private String countryOfIncorporation;
         @JsonProperty("category") private String category;
         @JsonProperty("url") private String url;
         @JsonProperty("businessEntityType") private String businessEntityType;