API documentation

Equipe Online API, version 2

Equipe Online publishes show schedules, start lists and results for equestrian competitions. This API is how you build on that: read the documents and results for the riders someone has given you access to, follow riders and horses, and be told when results arrive.

Everything lives under https://online.equipe.com. Requests and responses are JSON, and every request needs an access token. Getting one takes an application and a short review, because we want to know who is calling.

• Getting started
• Which authentication do I need
• Personal access tokens
• OAuth 2.0
• Sign in with Equipe
• Scopes
• Making requests
• Endpoint reference
• Errors
• What a token cannot do
• Getting help

Getting started

The shortest path from nothing to a working request is a personal access token. It takes three steps.

1. Apply for developer access at https://online.equipe.com/developer_application/new. Tell us what you are building and which company or person is behind it. We read every application and answer by email.
2. Create a key once you are approved. Your developer page links to API keys; pick the scopes you need and copy the key. It is shown once and stored hashed, so if you lose it you create a new one.
3. Call the API with the key as a bearer token.

curl -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/profiles

That returns the riders your account has been given access to. If the list is empty, connect a rider to your account first — the personal endpoints all follow from that list.

Two things to know before you build. The API is not for building something Equipe already offers. An app that competes with our own products will not be approved. And developer access is ours to give and ours to take back. We can withdraw it at any time, and when we do we will tell you why.

Back to top

Which authentication do I need

Two kinds of token reach the API, and the difference is whose data you are reading.

If you are collecting results for your own club, take a personal access token. If you are building something riders log in to, you want OAuth.

Back to top

Personal access tokens

A personal access token is a key you make for yourself. It carries your own access: the riders connected to your account, your documents, your notifications. Treat it like a password, because it is one.

• Choose read, write or both when you create it. Nothing else.
• It does not expire. It stops working when you revoke it, and not before.
• There is no refresh token, because there is nothing to refresh.
• We show it once. We keep a hash, so we cannot show it to you again and neither can anyone who reads our database.
• Revoking one takes effect on the next request.

Give each integration its own key. Then revoking the one that leaked does not stop everything else you run.

Back to top

OAuth 2.0

Use OAuth when your product acts for other Equipe users. They stay in control: they see what you are asking for, they approve it, and they can take it back.

We support the authorization code flow. There is no implicit flow, no password grant and no client credentials grant.

Applications are confidential, and we send no CORS headers. The token exchange uses your client secret, so it has to happen on your server. A browser-only client cannot complete it.

Register an application

Approved developers register applications on their developer page. You give the name and description people see when they authorize you, a website and privacy policy, a support address, and one redirect URI per line. You get a client id and a client secret; the secret is shown once.

Send the user to Equipe

GET https://online.equipe.com/oauth/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https://example.com/callback
  &response_type=code
  &scope=read
  &state=RANDOM_STRING

If they are not signed in we ask them to, and bring them back. Then they see who is asking, what you say your application does, links to your site and privacy policy, and the list of things you want to be allowed to do. Denying sends them back to your redirect URI with error=access_denied.

Exchange the code

Approving sends them to your redirect URI with ?code=…&state=…. The code is good for ten minutes and once.

curl -X POST https://online.equipe.com/oauth/token \
  -d grant_type=authorization_code \
  -d code=RETURNED_CODE \
  -d redirect_uri=https://example.com/callback \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET

{
  "access_token": "…",
  "token_type": "Bearer",
  "expires_in": 7200,
  "refresh_token": "…",
  "scope": "read",
  "created_at": 1786042773
}

Refresh, and the one rule about it

Access tokens last 2 hours. Trade the refresh token for a new pair before or after it runs out — the user is not involved.

curl -X POST https://online.equipe.com/oauth/token \
  -d grant_type=refresh_token \
  -d refresh_token=YOUR_REFRESH_TOKEN \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET

Refresh tokens rotate. Every refresh gives you a new refresh token and retires the old one as soon as the new access token is used. Store the new one and forget the old. If an old refresh token turns up again we treat it as a copy and reject the exchange, which means a client that retries with a stale token loses the whole chain and has to ask the user again.

PKCE

We accept S256 and plain. It is not required, and we recommend it anyway: send code_challenge and code_challenge_method with the authorize request, and code_verifier with the exchange.

Giving a token back

curl -X POST https://online.equipe.com/oauth/revoke \
  -d token=THE_TOKEN \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET

POST /oauth/introspect tells you whether a token is still good, and GET /oauth/token/info describes the token you are holding. Users manage what they have authorized from their own account page, and revoking there stops your access immediately.

Back to top

Sign in with Equipe

On top of OAuth we speak OpenID Connect, so people can sign in to your product with their Equipe account. Any standard OIDC library will do the work if you point it at our discovery document.

https://online.equipe.com/.well-known/openid-configuration

That document is the authority. If anything here disagrees with it, believe the document.

• Issuer: https://online.equipe.com
• Public keys: https://online.equipe.com/oauth/discovery/keys
• User info: https://online.equipe.com/oauth/userinfo

Ask for the openid scope, plus profile and email for the claims you need. You can ask for read or write in the same breath, and the consent screen lists all of it together.

The claims are in the id_token and at the user info endpoint alike.

curl -H "Authorization: Bearer $ACCESS_TOKEN" \
  https://online.equipe.com/oauth/userinfo

{
  "sub": "1",
  "name": "Jon Stenqvist",
  "email": "jon@example.com",
  "email_verified": true
}

Back to top

Scopes

A token carries scopes, and scopes decide what it may do. These are the words the user sees when they authorize your application.

read and write reach the API. openid, profile and email are about identity and are only useful for signing in. An application may only ask for scopes from this list.

Read and write are separate, not a ladder. A token with only write is refused by the endpoints that need read, exactly as the other way round. Most integrations want both.

Back to top

Making requests

Send the token on every request:

Authorization: Bearer YOUR_TOKEN

Send Content-Type: application/json when you have a body, and nest the body under the name of the thing you are working with: {"notification_subscription": {"active": true}}, not {"active": true}.

Timestamps are ISO 8601 in UTC.

Blank values are left out. Most responses drop keys whose value is null, false or empty rather than sending them. A notification that has not been read has no read key at all, so read the absence of a key as its blank value. The rider list is the one exception: it keeps its zeros and its false, because a follower count of zero is an answer.

Only /api/v2/documents is paged, with offset. Everything else returns what it has.

We do not send CORS headers, so call us from your server rather than from a browser. There is no published rate limit; use the API at a rate you would be comfortable explaining, and cache what you can.

Back to top

Endpoint reference

Riders

curl -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/profiles

[
  {
    "id": 42,
    "name": "Jessie Stenqvist",
    "target_identifier": "rider_820f70fbf096631173bc380f515a0ad0",
    "identifier_key": "svrf",
    "identifier_id": "17860",
    "birth_year": null,
    "age": null,
    "logo_id": "802",
    "logo_group": "svrf",
    "private_notifications": true,
    "approved_followers_count": 21,
    "user_approved_followers_count": 0,
    "auto_approved_followers_count": 21,
    "pending_followers_count": 2
  }
]

Documents

curl -H "Authorization: Bearer $TOKEN" \
  "https://online.equipe.com/api/v2/documents?offset=50"

[
  {
    "id": 9182,
    "label": "Result list",
    "pdf_logo_identifier": "8fa1c0…",
    "created_at": "2026-08-02T14:11:53.000Z",
    "meeting_id": 68000,
    "meeting_name": "Falsterbo Horse Show",
    "meeting_class_name": "145 cm Two phases",
    "class_section_id": 551202,
    "rider_name": "Jessie Stenqvist"
  }
]

Results

curl -H "Authorization: Bearer $TOKEN" \
  "https://online.equipe.com/api/v2/results?offset=25"

[
  {
    "id": 21485922,
    "class_section_id": 1283367,
    "rank": 1,
    "result_preview": "68.723",
    "meeting_class_start_at": "2026-08-16T11:34:00.000Z",
    "meeting_name": "Ödåkra Ridsällskap",
    "meeting_class_name": "Medelsvår B:5",
    "rider_name": "Jessie Stenqvist",
    "horse_name": "Red Zolo (SWB)",
    "club_name": "Helsingborgs Fältrittklubb",
    "venue_country": "SWE",
    "discipline": "D",
    "logo_id": "235",
    "logo_group": "svrf",
    "rider_notification_identifier": "rider_820f70fbf096631173bc380f515a0ad0",
    "horse_notification_identifier": "horse_84a945663f765b9156b0104937cd1762"
  }
]

curl -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/profiles/42/results

curl -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/starts/21485922/score_sheets

[
  {
    "marking_sheet_id": "10145",
    "name": "Medelsvår B:5",
    "description": "Edition 2024, arena 20x60, max 470 points, time approx. 5.5 min",
    "sheet_type": "D",
    "max_score": 470.0,
    "total": 296.0,
    "percent": "62.979",
    "rank": 3,
    "judges": [
      {
        "judge_by": "C",
        "alias": "C",
        "name": "Annica Wiberg",
        "country": "SWE",
        "total": 296.0,
        "percent": "62.979",
        "technical_percent": null,
        "artistic_percent": null,
        "rank": 3,
        "deduction": 0.0
      }
    ],
    "items": [
      {
        "position": 0,
        "group_no": "1",
        "section": "technical",
        "keyword": "Inridning",
        "place": "AX\nX\nXC",
        "instruction": "Inridning i samlad galopp\nHalt - hälsning\nSamlad trav",
        "coefficient": 1.0,
        "scale": 10,
        "exclude_max_score": false,
        "points": { "C": 7 }
      },
      {
        "position": 30,
        "group_no": "3",
        "section": "artistic",
        "keyword": "Lösgjordhet",
        "place": null,
        "instruction": "Lösgjordhet (eftergift på tygeln, formen, accepterande av bettet…)",
        "coefficient": 2.0,
        "scale": 10,
        "exclude_max_score": false,
        "points": { "C": 6 }
      },
      {
        "position": 32,
        "group_no": null,
        "section": "technical_deduction",
        "keyword": "Poängavdrag",
        "place": null,
        "instruction": "Felridning första gången 2p - Felridning andra gången 4p",
        "coefficient": 1.0,
        "scale": 10,
        "exclude_max_score": true,
        "points": {}
      }
    ]
  }
]

Notifications

curl -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/push_messages

{
  "push_messages": [
    {
      "id": 771,
      "alert": "Jessie Stenqvist is next to go in 145 cm Two phases",
      "event": "start",
      "meeting_id": 68000,
      "meeting_name": "Falsterbo Horse Show",
      "class_section_id": 551202,
      "created_at": "2026-08-02T14:09:00.000Z"
    }
  ],
  "push_notification": { "id": 12, "unread_count": 1 }
}

curl -X PUT -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/push_messages/read_all

curl -X DELETE -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/push_messages/771

curl -X DELETE -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/push_messages

Following riders and horses

curl -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/notification_subscriptions

curl -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/targets/rider_820f70…/notification_subscriptions

curl -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"notification_subscription":{"target_identifier":"rider_820f70…","active":true,"result_enabled":true}}' \
  https://online.equipe.com/api/v2/notification_subscriptions

curl -X PATCH -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"notification_subscription":{"result_enabled":false}}' \
  https://online.equipe.com/api/v2/notification_subscriptions/1234

curl -X DELETE -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/notification_subscriptions/1234

Attachments

Uploading and removing files is for organizers and course designers. Reading the list is open to any account.

curl -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/meeting_classes/1252772/attachments

[
  {
    "id": 88211,
    "meeting_class_id": 1252772,
    "name": "Course design",
    "contain": "course_design",
    "url": "https://online-uploads.equipeassets.com/assets/88211/original.pdf",
    "file_name": "course_design.pdf",
    "content_type": "application/pdf",
    "file_size": 148733,
    "created_at": "2026-08-02T14:11:53.000Z"
  }
]

curl -X POST -H "Authorization: Bearer $TOKEN" \
  -F "attachment[name]=Course design" \
  -F "attachment[file]=@course_design.pdf" \
  https://online.equipe.com/api/v2/meeting_classes/1252772/attachments

{
  "id": 88211,
  "meeting_class_id": 1252772,
  "name": "Course design",
  "contain": "course_design",
  "url": "https://online-uploads.equipeassets.com/assets/88211/original.pdf",
  "file_name": "course_design.pdf",
  "content_type": "application/pdf",
  "file_size": 148733,
  "created_at": "2026-08-02T14:11:53.000Z"
}

curl -X DELETE -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/attachments/88211

Account

curl -H "Authorization: Bearer $TOKEN" \
  https://online.equipe.com/api/v2/users/me

{
  "user": {
    "id": 1,
    "name": "Jon",
    "email": "jon@example.com",
    "roles": ["admin"],
    "created_at": "2020-11-23T10:09:01.000Z",
    "updated_at": "2026-07-22T16:58:50.000Z"
  }
}

Back to top

Errors

Back to top

What a token cannot do

Some things belong to the person, not to an integration. No access token reaches them, however many scopes it has, and they answer {"error": "token_access_forbidden"}:

• Signing in and signing out
• Changing an email address, which can merge two accounts
• Editing or creating an account

A key someone made for a cron job should not be able to take their account away from them, so it cannot.

Back to top

Getting help

Email info@equipe.com and a person will answer. Tell us what you are building and what you tried — we would rather help early than read about it afterwards.

Changes to the API are announced at help.equipe.com.

Back to top