The API, webhooks and the systems around them.
The REST API.
Requests go to /api on your portal address over HTTPS, with JSON in both directions. A script or another system authenticates with an API key sent as a bearer token. The key acts with the rights of the user who owns it, narrowed further if you choose.
The reference inside the portal lists more than 450 endpoints in 28 groups, from devices, positions and reports to dispatch, cameras, billing and the support desk. It has a search, and each row gives the method, the path, who may call it and what it does.
API keys
- Full access, read-only or limited to chosen devices
- An optional expiry date and a bar on sending commands
- Shown once when created, then kept only as a SHA-256 hash
- Revoked or replaced from the portal whenever you like
Webhooks.
Events leave your server as signed HTTPS POST requests to an address you choose.
Two ways to subscribe
An endpoint can take chosen event types for all devices or for a set of them, with no alert rule involved. An alert rule can also list an endpoint among its channels.
41 event types
In ten groups: device status, ignition, geofences, speed, safety alarms, sensors and fuel, assets, commands and maintenance, trips, and jobs and deliveries.
Delivery and retries
Delivery is at least once. A failed delivery gets five attempts in all, spaced 1 minute, 5 minutes, 30 minutes and 2 hours apart, and each payload has a stable event ID for de-duplication.
Tools for the receiving end
Send a test event, read recent deliveries with their response codes and times, redeliver one by hand, or rotate the signing secret.
Neutral headers
The header names and the user agent carry no platform name, so nothing of ours turns up in your clients' request logs.
Public addresses only
An endpoint that resolves to a private or internal address is refused, so a webhook cannot be aimed at the server's internal network.
What arrives at your endpoint
POST /hooks/fleet HTTP/1.1
Content-Type: application/json
User-Agent: Webhooks/1.0
X-Webhook-Id: 18342
X-Webhook-Event: geofenceEnter
X-Webhook-Timestamp: 1793606400
X-Webhook-Signature: t=1793606400,v1=<hex HMAC-SHA256 of "1793606400.<body>">
{"id":"…","type":"geofenceEnter","createdAt":"2026-11-02T08:00:00.000Z","data":{…}}To verify, compute the HMAC over the timestamp, a full stop and the raw body with the endpoint's secret, compare it with v1, and reject timestamps that are too old.
Connections that are already built.
| Connection | What it does |
|---|---|
| Partner apps (OAuth 2) | An app catalogue where clients add partner apps. Apps sign users in with the authorisation code flow and PKCE, then use access and refresh tokens. |
| High Mobility | Readings from the manufacturer's systems, such as odometer, fuel and service status, for a car linked by VIN. |
| Push notifications | Alerts to browsers and phones that have allowed notifications from your portal. |
| Telegram and WhatsApp | Alert channels. WhatsApp also carries the self-service menu and footage requests. |
| PayFast, Stripe, PayPal | Gateways for the invoices you send your clients, with signed callbacks. |
| Routing for dispatch | Travel times from the built-in estimate, a self-hosted OSRM server or Google. |
| Platform imports | Import tools for accounts, devices and stored history when you move from a supported platform. |
| Your mail server | Notifications, reports and invoices sent through the mail settings you enter, under your name. |
API and webhook questions
Can an API key be limited to some vehicles?
Yes. A key can be scoped to chosen devices, made read-only, barred from sending commands and given an expiry date. Its secret is shown once, when the key is made.
How do I check that a webhook came from my server?
Compute an HMAC-SHA256 of the timestamp, a full stop and the raw body, keyed with the endpoint's secret, and compare it with the v1 value in X-Webhook-Signature. Refuse stale timestamps to block replays.
Can I import data from my current platform?
From supported platforms, yes: import tools copy accounts and devices and bring the stored position history across in chunks. Units on other platforms are repointed to your server in batches; ask us what can come with them.
Related technical pages
Put it on your own server and try it.
Order online and your server is normally live the next day, with your domain and logo in place and the tracker ports open.