Sign In

HorseHQ for developers and agents

Everything HorseHQ publishes for machine consumers, in one place: the API surface, its specification, and what authentication does and does not allow today.

Machine-readable files

  • /llms.txt — what this product is, when to use it, and every link below, in the llmstxt.org format.
  • /openapi.json — the OpenAPI 3.1 description of the public HTTP surface. Every operation carries a unique operationId, a description and typed request and response schemas, so it converts directly into LLM function-calling tools. Also served from the API origin at https://api.horsehq.com/openapi.json.
  • /sitemap.xml — every public page on this site.

Markdown instead of HTML

Every public page on this site answers Accept: text/markdown with a Markdown copy of itself, per acceptmarkdown.com, and sends Vary: Accept so a shared cache keeps the two representations apart. Appending .md to a page path does the same thing for a client that cannot set headers.

curl -H "Accept: text/markdown" https://horsehq.com/
curl https://horsehq.com/about.md

The API

The public HTTP surface is small and honest: a health probe, two lead-capture forms, the specification itself, and one authenticated GraphQL endpoint at POST https://api.horsehq.com/api/graphql that carries every read and write the applications make.

  • Authentication is the session cookie issued by the sign-in flow, scoped to .horsehq.com. There is no public API key programme and no OAuth client registration today, so an integration that cannot present a person’s browser session cannot read barn data.
  • Authorization is per organization. Every record belongs to exactly one barn, and a session reads and writes only the barn it is active in. There is no cross-barn or anonymous read.
  • Introspection is disabled on the production GraphQL endpoint. Write to help@horsehq.com for the schema.
  • Errors follow the GraphQL over HTTP convention: an unauthenticated request receives 200 with an errors entry whose extensions.code is UNAUTHENTICATED, not a 401.

Health

GET https://api.horsehq.com/api/health is unauthenticated. It answers 200 when the database, both authentication instances and the GraphQL server are up, or 503 with the same body shape when one is not.

What is not available yet

  • A machine credential — API keys, OAuth clients or service accounts. Until one exists, an integration needs a person signed in.
  • Webhooks for barn events.
  • A public MCP server over barn data.

If you are building something that needs one of these, write to hello@horsehq.com — it helps us prioritise. For anything else, the contact page lists every address.