change your allowed_domains value www.britishhorseracing.com to https://www.britishhorseracing.com according to your target API behavior this is the valid origin,

• Invalid: Origin: www.britishhorseracing.com
• Valid: Origin: https://www.britishhorseracing.com

Sample code with requests:

import requests

for i in range(4214,4220):
    headers = {
        "User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0",
        "Origin": "https://www.britishhorseracing.com"
    }
    url = f"https://api09.horseracing.software/bha/v1/fixtures?page={i}"
    resp = requests.get(url, headers=headers).json()
    for i in resp['data']:
        races_url = f"https://api09.horseracing.software/bha/v1/fixtures/{i['fixtureYear']}/{i['fixtureId']}/races"
        print(races_url)

Output:

https://api09.horseracing.software/bha/v1/fixtures/2024/11672/races
https://api09.horseracing.software/bha/v1/fixtures/2024/1430/races
https://api09.horseracing.software/bha/v1/fixtures/2024/21901/races
https://api09.horseracing.software/bha/v1/fixtures/2024/861/races
https://api09.horseracing.software/bha/v1/fixtures/2024/1266/races
https://api09.horseracing.software/bha/v1/fixtures/2024/1739/races
https://api09.horseracing.software/bha/v1/fixtures/2024/16065/races
https://api09.horseracing.software/bha/v1/fixtures/2024/504/races
https://api09.horseracing.software/bha/v1/fixtures/2024/455/races
https://api09.horseracing.software/bha/v1/fixtures/2024/1452/races