Skip to content

Help center

Orbit APIs

← All guides

Every Orbit module has a public REST API. The entry point, the authentication and the limits are the same across all three; what changes are each sport’s resources.

Each card opens that sport’s full reference, with a test console and OpenAPI specification.

Practical shooting (IPSC)

Matches, athletes, divisions, Stages, Squads, ROs, registrations and practical shooting results.

/api/v1

Clay shooting

Matches, rounds, Squads, registrations, championships and clay target results.

/api/v1/clay

Precision shooting

Matches, modalities, series, bench relays, registrations, championships and precision results.

/api/v1/precisao

What is the same across all three

The same entity key opens all three modules — there is no per-sport credential. What decides its reach is whether the module is enabled for the entity.

Authentication

  1. In the entity dashboard, open API keys (owner only) and create a key with the permission you need — read, or read and write.
  2. Store the secret: it is shown only once. If you lose it, regenerate the key.
  3. Send on every request the header Authorization: Bearer <access_key>.<secret>.

Limits and responses

  • Entity scope: every resource is filtered by the key’s entity. An identifier from another club answers 404, never 403 — the key should not even know that record exists.
  • Write scope: POST, PUT, PATCH and DELETE require a write key. A read key gets 403.
  • Rate limit per key: responses carry the headers X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Going over the limit returns 429 with Retry-After.
  • Module switched off: if the entity does not have that sport enabled, its routes answer 404.
  • Opaque identifiers: every resource is addressed by a stable, non-sequential id, safe to expose and to store on your side.
  • external_id: every resource accepts your own identifier, unique within its scope. It is what lets you reprocess a load without duplicating records.
Required fields are defined by your entity. Before creating athletes or registrations, call GET /entidade: the requisitos_inscricao block returns exactly what is required and unique for your club.

What the API deliberately does not do

No module exposes field scoring or a stand-in for the athlete’s acceptance. Result integrity depends on who was on the firing line: the signature is born on the range, and an integration key has no way to reproduce that.

OpenAPI specifications

Need something the API does not cover? Custom integrations and new resources are considered case by case. Get in touch.