diff --git a/src/client.ts b/src/client.ts
index 2bb613a..a72d125 100644
--- a/src/client.ts
+++ b/src/client.ts
@@ -633,7 +633,16 @@ export class QubitOnClient {
 
   /** ESG scores. Returns a JSON array of `EsgScoresResponseEntry`. */
   async lookupESGScore(req: EsgScoresRequest, options?: RequestOptions): Promise<EsgScoresResponse> {
-    return this.post<EsgScoresResponse>('/api/esg/Scores', req, options);
+    // `country` and `domain` are bound on the server as [FromQuery] (not body).
+    // Strip them out of the body and serialise into the URL with safe encoding.
+    // The body keeps only companyName, esgId, and BaseRequest fields.
+    const { country, domain, ...body } = req;
+    const params = new URLSearchParams();
+    if (country) params.set('country', country);
+    if (domain) params.set('domain', domain);
+    const qs = params.toString();
+    const path = qs ? `/api/esg/Scores?${qs}` : '/api/esg/Scores';
+    return this.post<EsgScoresResponse>(path, body, options);
   }
 
   async domainSecurityReport(
diff --git a/src/models.ts b/src/models.ts
index 719bad5..159dcc3 100644
--- a/src/models.ts
+++ b/src/models.ts
@@ -1103,9 +1103,18 @@ export interface CreditAnalysisResponse extends BaseResponse {
 
 // ── ESG Score ─────────────────────────────────────────────────────────────
 
+/**
+ * Request shape for `lookupESGScore`. The body sent on the wire contains only
+ * `companyName` and `esgId` (plus `BaseRequest` fields). `country` and `domain`
+ * are bound on the server as `[FromQuery]` parameters on `ESGController` —
+ * the SDK strips them out of the body and serialises them into the URL
+ * query string. Sending them in the body would silently no-op.
+ */
 export interface EsgScoresRequest extends BaseRequest {
   companyName: string;
+  /** Sent as URL query parameter `?country=…`, NOT body. ISO 3166-1 alpha-2/3 or full name. */
   country?: string;
+  /** Sent as URL query parameter `&domain=…`, NOT body. e.g. "example.com". */
   domain?: string;
   esgId?: string;
 }