PRISM API Documentation

Overview

The PRISM API serves the records PRISM creates: protection risk incidents recorded by its analysts, European migration governance signals recorded by its migration desk, the weekly situation briefs and briefings PRISM writes from them and from ReliefWeb reports, and the alerts its detection rules raise.

It is read-only. Records come as JSON or CSV, under CC BY 4.0, from one base address and four endpoints that work the same way for every dataset. Access is by key, issued to a registered PRISM account after the request is reviewed.

PRISM also aggregates data published by others (OCHA, ACAPS, IDMC, IPC and more). Those datasets stay with their publishers and are not served by this API; their sources are listed in the Data Catalogue.

Getting Started

1. Create an accountRegister on prismonitor.eu with your full name and confirm your email address, or sign in.
2. Request accessOn the API page, name your organisation, the datasets you need and how you will use them, and accept the terms.
3. Receive your keyPRISM's editor reviews the request. Once it is approved, your key appears once on the API page; you are told by email.
4. Make a first callSend the key in the X-API-Key header to /api/v1/datasets.

Copycurl -H "X-API-Key: $PRISM_KEY" https://www.prismonitor.eu/api/v1/datasets

An organisation working with PRISM under an agreement can be issued a key directly; write to [email protected].

Authentication

Every request carries the key in the X-API-Key header. A key in the address is refused, since addresses are kept in server and proxy logs.

• A key starts with prism_. PRISM stores only a one-way hash of it, so a lost key cannot be shown again; rotate it to receive a new one.
• Rotating a key on the API page shows a new key once and stops the old one at once.
• A key carries the datasets it may read (its scopes), its limits and an expiry date, 12 months after issue unless agreed otherwise.
• A key is personal to the account it was issued to. Keep it out of shared code and notebooks; read it from an environment variable.

Base Address and Versions

All endpoints sit under https://www.prismonitor.eu/api/v1. The v1 in the path is the version of the API. Within it, each dataset has a schema version, returned with every response as schema_version.

• A new field or filter is added within a schema version, and clients should ignore fields they do not read.
• A field renamed or removed, or a change in its meaning, comes with a new schema version, announced to key holders by email at least 30 days ahead and recorded in the changelog.

Endpoints

{
  "datasets": [
    { "slug": "protection-risks", "name": "PRISM Protection Risk Register",
      "schema_version": 1, "licence": "CC BY 4.0", "records": 1720,
      "records_url": "/api/v1/datasets/protection-risks/records" }
  ],
  "key": { "prefix": "prism_Ab3dE9xQ", "tier": "partner", "expires_utc": "2027-10-30T09:00:00Z",
           "per_minute": 60, "per_day": 10000 },
  "generated_utc": "2026-10-30T09:12:44Z"
}

{
  "slug": "protection-risks", "schema_version": 1, "licence": "CC BY 4.0",
  "citation": "PRISM (2026). Protection Risk Register. prismonitor.eu, read <date>.",
  "filters": { "country": "SDN", "date_from": "2026-10-01" },
  "count": 100, "next_cursor": "WyJQUklTTS0xMTA0IiwiU0ROIl0",
  "records": [
    { "entry_id": "PRISM-1104", "iso3": "SDN", "country": "Sudan", "area": "North Darfur",
      "risk_code": "R02", "risk_label": "Attacks on civilians and other unlawful killings, ...",
      "population_groups": ["IDPs"], "description": "...", "source_name": "...",
      "source_date": "2026-10-14", "source_link": "https://...", "recorded_by": "PRISM",
      "changed_utc": "2026-10-15T08:02:11Z" }
  ],
  "generated_utc": "2026-10-30T09:12:44Z"
}

{
  "since": "2026-10-28T00:00:00Z", "count": 2, "next_cursor": null,
  "changes": [
    { "change": "upsert", "record": { "entry_id": "MSIG-0612", "...": "..." } },
    { "change": "withdrawn", "key": { "entry_id": "MSIG-0587" }, "changed_utc": "2026-10-29T14:20:03Z" }
  ]
}

Datasets

PRISM Protection Risk Register protection-risks

Protection risk incidents recorded by PRISM's analysts from published reports, one entry per event, each on one of the Global Protection Cluster's 15 protection risks, with its area, the population groups named, a description written by PRISM and the source. PRISM's own record from August 2026; the only protection record PRISM keeps from 1 October 2026.

Record key entry_id + iso3 · schema version 1 · partner tier

Risk code: R01 Abduction, kidnapping, enforced disappearance, arbitrary or unlawful arrest and/or detention; R02 Attacks on civilians and other unlawful killings, and attacks on civilian objects; R03 Child and forced family separation; R04 Child, early or forced marriage; R05 Discrimination and stigmatization, denial of resources, opportunities, services and/or humanitarian access; R06 Disinformation and denial of access to information; R07 Forced recruitment and association of children in armed forces and groups; R08 Gender-based violence; R09 Impediments and/or restrictions to access to legal identity, remedies and justice; R10 Presence of Mine and other explosive ordnance; R11 Psychological/emotional abuse or inflicted distress; R12 Theft, extortion, forced eviction or destruction of personal property; R13 Torture or cruel, inhuman, degrading treatment or punishment; R14 Trafficking in persons, forced labour or slavery-like practices; R15 Unlawful impediments or restrictions to freedom of movement, siege and forced displacement. Taxonomy: Global Protection Cluster's 15 protection risks

Cite as: PRISM (2026). Protection Risk Register. prismonitor.eu, read <date>.

PRISM Migration Signals migration-signals

European migration governance signals recorded by PRISM's migration desk: policy acts, court rulings, incidents and data releases on 12 themes, each with its stage in the policy cycle, its place (member state, route, partner or origin country, EU institution) and its source.

Record key entry_id · schema version 1 · partner tier

Theme: M01 Arrivals, routes and deaths; M02 Border management and control; M03 Asylum procedure and reception; M04 Return, readmission and detention; M05 Externalisation and partnerships; M06 Legal pathways and labour migration; M07 Status and integration; M08 Courts, legality and oversight; M09 Rights violations in migration control; M10 Funding and budgets; M11 Statistics and data releases; M12 Displacement drivers in countries of origin. Stage: proposed, adopted, implemented, ruled, incident, data. Scope: eu, member_state, uk, route, partner, origin. Route: cmed Central Mediterranean; emed Eastern Mediterranean; wmed Western Mediterranean; atl Atlantic (Canaries); chan Channel; wbalk Western Balkans; east Eastern land border

Cite as: PRISM (2026). Migration Signals. prismonitor.eu, read <date>.

PRISM Weekly Protection Situation Briefs situation-briefs

A weekly situation brief per country, written by a language model from PRISM's register entries of the 90 days to the country's latest entry, PRISM's country briefing and ReliefWeb reports, every passage cited. One edition per country and ISO week; an edition is never changed, and a citation to an entry later withdrawn is marked withdrawn.

Record key iso3 + week · schema version 1 · partner tier

Citation ids: PRISM-0123 a register entry; RW 1234567 a ReliefWeb report; CS the country briefing

Cite as: PRISM (2026). Weekly Protection Situation Briefs, written by a language model. prismonitor.eu, read <date>.

PRISM Weekly Country Situation Briefings country-briefings

A weekly situation briefing per country, written by a language model from the latest ReliefWeb reports PRISM's archive holds for it: crisis dynamics, the people affected, sector needs, access and funding, as the reports state them. It is the Updates tab of each country page and the general situation the protection briefs read. One edition per country and ISO week; an edition is never changed.

Record key iso3 + week · schema version 1 · partner tier

Report id: RW 1234567, a ReliefWeb report; its link opens it on ReliefWeb

Cite as: PRISM (2026). Weekly Country Situation Briefings, written by a language model. prismonitor.eu, read <date>.

PRISM Alerts alerts

Movements PRISM's detection rules find in its archives (food insecurity, displacement, crisis severity, disaster alerts, protection, aid worker security, agricultural hotspots, asylum applications), each reviewed by PRISM's editor before publication, with the figures and thresholds that fired it, the source, and a narrative written by a language model. Only published alerts are served. Alerts from ACLED data are not served through the API under ACLED's licence terms; they are on PRISM's alerts pages.

Record key alert_id · schema version 1 · partner tier

Indicator: food_insecurity Food insecurity; conflict_displacement Conflict displacement; disaster_displacement Disaster displacement; inform_severity INFORM Severity; disaster Disaster alert; conflict Armed conflict; protection Protection; aid_worker_security Aid worker security; agriculture Agricultural hotspots; rainfall Rainfall; asylum Asylum applications. Rule: ipc_current_change Phase 3+ change between comparable IPC analyses; ipc_projection_worsens IPC projection against the current period; ipc_phase5 Population in IPC Phase 5 where the previous analysis had none; displacement_window Displacement in a month against the country's own record; inform_severity_change INFORM Severity moving between releases; gdacs_alert GDACS Red or Orange alert; protection_new_risk A protection risk type recorded where the register had none in twelve months; protection_volume Protection entries in a month against the country's own record; awsd_window Attacks on aid workers in a month against the country's own record; asap_hotspot JRC ASAP hotspot class rising; rainfall_anomaly Three dekads of rainfall far from the long-term average; asylum_applications First-time asylum applications against the previous twelve months. Direction: worsening, improving

Cite as: PRISM (2026). PRISM Alerts. prismonitor.eu, read <date>. Cite the source named in each alert for its figures.

Pagination

A page holds up to 500 records. When more remain, the response carries next_cursor; pass it as cursor with the same filters to read the next page. The last page has next_cursor: null. Records are ordered by their key, so a record added while you read never moves another to a page you have already read. In CSV, the cursor is in the X-Next-Cursor response header.

Keeping a Copy Current

Read the full dataset once from records. Then, at each update, read changes with the time of your last update and apply every change in order:

• upsert: add the record, or replace your copy of the record with the same key.
• withdrawn: PRISM no longer serves the record. It was corrected into another entry, found to repeat another, or taken down. Delete your copy.

Times are to the second, so a change can appear in two reads; applying it twice is safe. Keep the latest changed_utc (or the time of your request) and pass it as since next time.

Responses

Every JSON response carries the dataset's slug, name, schema_version, licence, citation and generated_utc beside its records. Dates are YYYY-MM-DD; times are UTC, YYYY-MM-DDTHH:MM:SSZ; countries are ISO 3166-1 alpha-3 codes. Lists (population groups, additional sources) are JSON arrays, and in CSV are joined with ; . A field with no value is an empty string or null, never left out.

Errors

An error is JSON with error (the reason) and status.

Rate Limits

A key may make 60 requests a minute and 10,000 a day unless a different limit was agreed; /datasets shows your key's limits. A full read of the largest dataset takes a handful of requests at 500 records a page, and a daily update through changes usually takes one.

Code Examples

Each example reads every protection risk entry for Sudan, a page at a time, with the key read from the PRISM_KEY environment variable.

Copycurl -H "X-API-Key: $PRISM_KEY" \
  "https://www.prismonitor.eu/api/v1/datasets/protection-risks/records?country=SDN&limit=500"

# the next page: add &cursor=<next_cursor>
# CSV instead of JSON: add &format=csv

Copyimport os, requests

BASE = "https://www.prismonitor.eu/api/v1"
HEADERS = {"X-API-Key": os.environ["PRISM_KEY"]}

def records(dataset, **filters):
    params = {**filters, "limit": 500}
    while True:
        r = requests.get(f"{BASE}/datasets/{dataset}/records",
                         headers=HEADERS, params=params, timeout=60)
        r.raise_for_status()
        page = r.json()
        yield from page["records"]
        if not page["next_cursor"]:
            break
        params["cursor"] = page["next_cursor"]

sudan = list(records("protection-risks", country="SDN"))

Copylibrary(httr2)

records <- function(dataset, ...) {
  out <- list(); cursor <- NULL
  repeat {
    resp <- request("https://www.prismonitor.eu/api/v1") |>
      req_url_path_append("datasets", dataset, "records") |>
      req_headers(`X-API-Key` = Sys.getenv("PRISM_KEY")) |>
      req_url_query(..., limit = 500, cursor = cursor) |>
      req_perform() |>
      resp_body_json()
    out <- c(out, resp$records)
    if (is.null(resp$next_cursor)) break
    cursor <- resp$next_cursor
  }
  out
}

sudan <- records("protection-risks", country = "SDN")

Licence, Citation and Terms of Use

• The records and their compilation are published under CC BY 4.0. Cite PRISM with the dataset's name and the date you read it, as each response's citation gives it.
• Every record links to its source. Descriptions are written by PRISM; the sources' own text stays with their publishers and under their terms.
• The weekly situation briefs and country briefings are written by a language model from the entries and reports they cite. Say so wherever you use them.
• Delete any record the changes feed reports as withdrawn, at your next update.
• Keys are personal to the account they were issued to. Do not share or publish them; rotate a key you believe exposed.
• PRISM may change limits, suspend a key during an incident, or revoke a key used against these terms, and tells the holder why.
• The API is provided as it is, without a service-level commitment. PRISM announces planned changes and downtime to key holders by email.

Data Responsibility

The API serves no personal data. An entry names the analyst who recorded it only when the analyst chose to be named; otherwise it reads PRISM. Account identifiers, review notes and moderation records never leave PRISM. When a contributor deletes their account, the entries they filed stay and their name is removed from them, and the change reaches key holders through the changes feed.

Changelog

Support

Questions about the API, a higher limit or a dataset you need: [email protected]. Security issues: see security.txt.

Documentation version 1.1, 30 October 2026 · Download as PDF