Prism Connect API
Build on Prism Connect
Read and sync horse, ownership, racing and task data from Prism straight into your own systems — over a secure, server-to-server REST API. One key, predictable JSON, no scraping.
Request
curl https://api.prism.horse/connect/v1/horses \ -H "X-API-KEY: $PRISM_API_KEY"
200 · Response
{ "responseData": [ { "id": "h_8K2P", "name": "Northern Light", "status": "in_training" } ], "error": null }
What you can access
One consistent JSON shape across every domain. Every path lives under a stable, versioned /connect/v1 prefix.
Horses
Profiles, training status, availability and location history for the horses on an account.
Ownership
Who owns what, share splits and ownership changes over time.
Health & notes
Vaccination records and structured veterinary notes, scoped per note type.
Tasks
Create and read trackwork, treatments, transport and general tasks.
Racing
Race schedules, entries, results and full race history.
Updates
Horse reports, media and stable updates as published to owners — including group updates, which arrive as a single event covering every horse in the group.
Transactions
The billing ledger: charges against a horse or account, with their payable and receivable coding.
Webhooks
Rather than asking us what changed, let us tell you. Point Prism at an HTTPS endpoint, pass a one-time verification handshake, and we will POST a signed JSON payload the moment something happens — across 58 event types covering tasks, horse notes, media, reports and stable updates.
POST your endpoint
X-Prism-Event: horse.report.group.created
X-Prism-Signature: sha256=6f3a…
{
"eventType": "horse.report.group.created",
"occurredAt": "2026-07-30T04:00:00Z",
"accountId": 1234,
"data": {
"title": "Weekly stable update",
"reportCount": 2
}
}Signed with your secret
HMAC-SHA256 over the timestamp and the raw body, so you can prove a delivery came from Prism and was not replayed.
Retried automatically
5 attempts — 30 seconds, 2 minutes, 10 minutes, 30 minutes — with a stable delivery id so you can stay idempotent.
Subscribed per module
Tick only the modules you need. You get their events and nothing else.
One thing to know before you build: a webhook stays inactive until it passes the verification handshake, and an inactive endpoint receives nothing at all. Answer that first POST with HTTP 200 and you are live.
How it works
Prism Connect is a server-to-server REST API. Authenticate with an API key sent in the X-API-KEY header — no OAuth flow, no token refresh.
01
Get a key
Sign in to the Sandbox portal and generate an API key under Integration. Each key is scoped to one account.
02
Build in Sandbox
Develop against a full, isolated environment with safe data. Send your key in the X-API-KEY header on every request.
03
Go live
Swap in your production key and point at the same endpoints. Nothing else in your integration changes.
Rate limits
Limits exist so one busy integration cannot slow the platform down for the stables using it. They are generous for normal use — if you are hitting them regularly, there is usually a better-shaped request.
Reads
60
requests / minute
Every GET endpoint.
Writes
30
requests / minute
Anything that creates or changes data.
Per account, not per key — every key on an account shares the same allowance. Reads and writes are counted in two separate buckets, so heavy reading never starves your writes. These are the defaults. Limits can be raised per account — talk to us if your integration needs more headroom.
Know where you stand
These three come back on EVERY response, not just when you are throttled — read them and pace yourself rather than waiting to be rejected.
| Header | Meaning |
|---|---|
X-RateLimit-Limit | Your allowance for this bucket (read or write). |
X-RateLimit-Remaining | Requests left in the current window. |
X-RateLimit-Reset | Seconds until the window resets. |
Concurrency
At most 8 requests may be in flight at once per account. A request that cannot get a slot within 50ms is rejected rather than queued. This one carries no Retry-After — reduce your parallelism instead of retrying immediately. Exceeding it returns HTTP 429 with error code 1473.
Keep a worker pool at or below 8 concurrent requests per account. Batch endpoints and paging beat firing many small requests at once.
Size limits
| Limit | Value | Notes |
|---|---|---|
| Page size | 20 by default, 100 maximum | Out-of-range values are clamped, never rejected. |
| Items per write | 50 | Applies to endpoints that accept an array. |
| Request body | 1 MB | Applies to JSON request bodies you send us. |
Staying inside the limits
- Read the X-RateLimit-Remaining header and slow down before you hit zero.
- Honour Retry-After on a 429 — retrying immediately just burns your next window.
- Use webhooks instead of polling where an event exists for what you need; it is faster for you and cheaper for both of us.
- Page through large result sets rather than requesting the maximum page size in a tight loop.
- Cache reference data that rarely changes instead of re-fetching it per request.
An MCP server for AI agents
We're building a Model Context Protocol server for Prism Connect, so AI assistants and agents can read horse, ownership, racing and task data — and act on it — without any glue code. Point your agent at Prism, authenticate once, and let it work the way the rest of the API already does.
Want early access? Mention it when you get in touch.
Ready to try it?
Explore every endpoint and send live requests right in the browser — no setup, no installs.
Open the API Playground