To note, SCHUFA requires all requests to contain a feature code describing the GDPR-"legitimate reason" for the request, and only some affect credit. But those consuming the API have long sent wrong codes, and nobody in the chain cares.