DSS API: AppendToList returns 403 forbidden depending on content in request

Question

Whilst appending instruments to an Instrument List, we use two APIs: Vailidate: https://selectapi.datascope.lseg.com/RestApi/v1/Extractions/InstrumentListValidateIdentifiers AppendValidated: https://selectapi.datascope.lseg.com/RestApi/v1/Extractions/InstrumentLists('0x09d8d45823dbf1c6')/DataScope.Select.Api.Extractions.InstrumentListAppendValidated This allows us to filter invalid instruments before appending to the list. However, since the 11 MAY 2026 we have noticed that certain ISIN cause a HTTP 403 response from the AppendToList. 1. Call validation with payload: {
"InputsForValidation":[
{
"Identifier":"US625517PM31",
"IdentifierType":"Isin",
"UserDefinedIdentifier":"US625517PM31"
}
],
"KeepDuplicates":true
} 2. Get validated response: {
"@odata.context":"https://selectapi.datascope.lseg.com/RestApi/v1/$metadata#DataScope.Select.Api.Extractions.SubjectLists.InstrumentsValidateIdentifiersResult",
"ValidatedInstruments":[
{
"Identifier":"US625517PM31",
"IdentifierType":"Isin",
"UserDefinedIdentifier":"US625517PM31",
"Source":"EJV",
"Key":"VjF8MHgwMDEwNmFhNWI0ZWMwNTgyfDB4MDAxMDZhZGViOGVjMDVmNXxFSlZ8TVVRUnxNVU5JfE1VTkl8VXxOfDYyNTUxN1BNMz1SUlBTfE1VTkk",
"Description":"OR 5.000 06/15/28",
"InstrumentType":"MortAggregate",
"Status":"Valid"
}
],
"ValidationResult":{
"ValidInstrumentCount":1,
"OpenAccessSegments":[ "StandardSegments":[ { "Code":"U", "Description":"Muni", "Count":1 } ], "ValidationDuplicates":[ ], "Messages":[ ] ], }
} 3. Take the ValidatedInstrument and append to list {
"ValidatedInstruments": [
{
"Identifier": "US625517PM31",
"IdentifierType": "Isin",
"UserDefinedIdentifier": "US625517PM31",
"Source": "EJV",
"Key": "VjF8MHgwMDEwNmFhNWI0ZWMwNTgyfDB4MDAxMDZhZGViOGVjMDVmNXxFSlZ8TVVRUnxNVU5JfE1VTkl8VXxOfDYyNTUxN1BNMz1SUlBTfE1VTkk",
"Description": "OR 5.000 06/15/28",
"InstrumentType": "MortAggregate",
"Status": "Valid"
}
],
"KeepDuplicates": false
}

4. Here we get a 403 FORBIDDEN response. Please note, this works for 99% of validated instruments. However there are a few which cause this 403 response. ISIN US68609UPA78 is another example. Can you explain why the AppendToList fails with Validated Instruments for a very small amount of ISIN?

Nowshad · Answer

We checked with our development team via above raised case 16032554.

Upon checking the reason for blocking the request, we found the request is blocked due to violation of WAF rule, with message stating that “SQL Injection Attack”

Description for an ISIN US625517PM31 contains "OR 5.000 06/15/28” which is causing the blocking of request.

As per WAF (A Web Application Firewall (WAF) acts as a protective shield between your web application and the internet) security rule, “OR” keyword is one of the patterns matching in rule criteria and, hence blocking the request.

Our development team have put few exceptions to the keywords (e.g. OR, ROUND etc) to avoid further block by WAF rule defined for “SQL Injection Attack” and was leading to 403 forbidden error. This has been resolved. I tried running few queries now again in API. I see issue has been sorted and are able to append these instruments successfully without any errors like 403. Please find below screenshot for your reference.

Jirapongse · Answer

The cause of the error could be from the "Description" field.

The following one works:

{

    "ValidatedInstruments": [

        {

            "Identifier": "US625517PM31",

            "IdentifierType": "Isin",

            "UserDefinedIdentifier": "US625517PM31",

            "Source": "EJV",

            "Key": "VjF8MHgwMDEwNmFhNWI0ZWMwNTgyfDB4MDAxMDZhZGViOGVjMDVmNXxFSlZ8TVVRUnxNVU5JfE1VTkl8VXxOfDYyNTUxN1BNMz1SUlBTfE1VTkk",
            "Description": "",

            "InstrumentType": "MortAggregate",

            "Status": "Valid"  

        }

    ],

    "KeepDuplicates": false

}

The following one doesn't work.

{

    "ValidatedInstruments": [

        {

            "Identifier": "US625517PM31",

            "IdentifierType": "Isin",

            "UserDefinedIdentifier": "US625517PM31",

            "Source": "EJV",

            "Key": "VjF8MHgwMDEwNmFhNWI0ZWMwNTgyfDB4MDAxMDZhZGViOGVjMDVmNXxFSlZ8TVVRUnxNVU5JfE1VTkl8VXxOfDYyNTUxN1BNMz1SUlBTfE1VTkk",
            "Description": "OR 5",

            "InstrumentType": "MortAggregate",

            "Status": "Valid"  

        }

    ],

    "KeepDuplicates": false

}

I have created a service request to the DSS support team on your behalf to verify what the problem is. The case number is 16032554. The support team will contact you regarding this issue.

scottpaisey · Answer

Thank you for the swift answer - we will have to make some changes to accommodate this rather strange quirk of the endpoint.

The API Documentation does define the required payload to AppendToList to include a collection of ValidationIndentifier returned from the Validation Request.

This has only recently started to occur, after 6 years of integration.

Many thanks for your help - let's hope there are no more quirks like this, as it has had an big impact on the business, given we were unable to retrieve 1000s of details for Instruments (one ISIN in a list of 2500k stops the whole AppendToList request from succeeding).

EXPLORE OUR SITES