Updated Oct 2026

The reviews API for SaaS products that need review features

Prisma is a reviews API for SaaS products: CRMs, POS systems and booking software that want their customers’ reviews inside the app. Your users connect their own Google Business Profile, Trustpilot, App Store, Google Play or Judge.me accounts from inside your product. You get one normalized JSON format, signed webhooks for new reviews and replies, and one API key for every platform.

Get API key

Build with test keys and 2 free locations. No card required. No sales call.

The problem: “Can we see our Google reviews in here?”

Your customers live in your product all day. A restaurant uses your POS. A clinic uses your booking system. A sales team uses your CRM. Sooner or later they ask to see and answer their reviews without leaving it.

Building that yourself means several separate integrations:

• Google: access to the Google Business Profile API is not automatic. You apply with a Cloud project number, and Google approves or rejects it. Until then your quota is 0 queries per minute (Google prerequisites).
• Trustpilot, App Store, Google Play: each has its own auth model, its own data shape and its own limits. Google Play, for example, only returns reviews from the last 7 days.
• Multi-tenant plumbing: storing tokens per customer, refreshing them, handling revoked access and retrying failed replies.

That is weeks of work for a feature that is not your core product.

How SaaS teams solve it today

How a reviews API for SaaS works with Prisma

Your backend holds one Prisma API key. Each of your customers connects their own profiles through Prisma, Prisma keeps their tokens and syncs their reviews, and your backend reads them over REST and receives webhooks.

Connections for your users

Call POST /v1/connections for each customer and platform. Put your own tenant id in metadata: Prisma stores it on the connection and returns it whenever you list connections. For OAuth platforms (Google, Trustpilot) you get an authorization_url. Your user opens it from your app, approves access with the account that owns their business profile and lands back on your redirect_url. You never handle their Google or Trustpilot password.

curl -X POST https://api.prismareviews.com/v1/connections \
  -H "Authorization: Bearer $PRISMA_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: acme-google-1" \
  -d '{"platform": "google", "redirect_url": "https://app.yoursaas.com/settings/reviews", "metadata": {"tenant_id": "acme-restaurants"}}'

App Store, Google Play and Judge.me connect with credentials your user creates in their own console (an App Store Connect API key, an invitation to Prisma’s service account in Play Console, a Judge.me private token), which you pass in credentials. Prisma checks them against the platform before storing anything, encrypted.

Prisma uses its own Google Cloud project, so you don’t apply for Google Business Profile API access yourself. More on Google Business Profile API access.

One format for every platform

Every review comes back with the same fields: id, platform, location_id, rating, title, text, author, language, created_at, updated_at, reply and url. One component in your UI renders Google, Trustpilot and app store reviews. GET /v1/locations tells you which connection_id each location belongs to, so you can map locations to tenants.

curl "https://api.prismareviews.com/v1/reviews?location_id=loc_123&since=2026-10-01T00:00:00Z" \
  -H "Authorization: Bearer $PRISMA_API_KEY"

// Node.js 18+
const res = await fetch(
  "https://api.prismareviews.com/v1/reviews?location_id=loc_123&since=2026-10-01T00:00:00Z",
  { headers: { Authorization: `Bearer ${process.env.PRISMA_API_KEY}` } }
);
const { data, next_cursor } = await res.json();

# Python 3
import os, requests

r = requests.get(
    "https://api.prismareviews.com/v1/reviews",
    params={"location_id": "loc_123", "since": "2026-10-01T00:00:00Z"},
    headers={"Authorization": f"Bearer {os.environ['PRISMA_API_KEY']}"},
)
reviews = r.json()["data"]

Lists are paginated with a cursor (data plus next_cursor), timestamps are ISO 8601 in UTC and every id has a prefix (rev_, loc_, con_). There are no SDKs yet: plain HTTP works from any language.

Webhooks instead of polling

Register an HTTPS endpoint with POST /v1/webhooks and get review.created, review.updated, reply.published, reply.failed and connection.updated events. Each event carries the review or connection id, the location_id and the platform, so you can update the right tenant and trigger an in-app notification. Every delivery is signed in the Prisma-Signature header (HMAC-SHA256 with your endpoint’s secret) and retried with exponential backoff if your endpoint fails.

Limits per tenant: what exists today

Prisma applies limits per workspace, not per tenant: your plan sets how many locations you can connect in total and how many requests per minute each API key can make (60 on Spark, up to 1,200 on Aurora). GET /v1/usage shows locations used, requests and replies this month. Per-tenant limits are not available yet, so if your free tier allows one location per customer, enforce that in your own code before you create the connection.

Replies from inside your product

Let users answer reviews in your UI and post with POST /v1/reviews/{id}/reply. Posting again replaces the reply, and DELETE /v1/reviews/{id}/reply removes it where the platform allows it (Google Play and Judge.me don’t). Each platform has its own length limit, for example 4,096 bytes on Google and 350 characters on Google Play, and Prisma returns reply_too_long with the maximum before anything is sent.

Example: a booking platform for clinics

This is an illustrative example, not a customer. A booking SaaS adds a “Reviews” tab. Each clinic clicks “Connect Google” in its settings, approves access, and its reviews appear next to its appointments. When a patient leaves a 2-star review, the review.created webhook triggers an in-app notification and the clinic replies without opening Google.

Pricing applied to SaaS

Plans are fixed by connected locations across all your tenants. Test keys are free and work with every platform using sample data.

Pass the cost through in your own plans, or include reviews in a premium tier. See pricing, integrations, security and our DPA.

FAQ

Do my users see the Prisma brand?

Only when they connect an OAuth platform: the consent screen names the app asking for access, which is Prisma’s. Everything else happens inside your product. White-label consent screens are not available.

Can my users read competitors’ reviews?

No. Prisma only reads reviews for businesses and apps that the user owns or manages and has connected. It is not a scraper.

How is this different from the Google reviews API?

Google offers reviews through the Business Profile API, which requires an approved application, and through the Places API, which returns at most 5 reviews per place. Prisma wraps the Business Profile API for owned locations and adds Trustpilot, the app stores and other platforms in the same format.

Can I set limits per tenant?

Not yet. Limits apply per workspace: the plan’s location count and a per-key rate limit. Store your tenant id in the connection metadata and enforce per-tenant limits in your own code.

What happens when a user revokes access?

Prisma marks the connection as needing reauthorization and sends a connection.updated webhook, and replies for that location return connection_reauth_required until the user reconnects. When you delete the connection, tokens are deleted immediately and review data 30 days later.

Is there a sandbox?

Yes. Test keys (pk_test_) work with every platform using sample data, and test and live data never mix. Your 2 free live locations let you try real accounts.