What are the rate limits?

The API allows 600 requests per minute per organization, with burst headroom for batch syncs. Every response includes X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers; if you exceed the limit you receive a 429 with a Retry-After header. Need more for a high-volume integration? Contact us.

Do you offer language SDKs?

Today the platform is a REST API plus signed webhooks, which works with any language and HTTP client. Official SDKs (starting with JavaScript/TypeScript and Python) are on our roadmap — until then, the API follows predictable, resource-oriented conventions that are straightforward to wrap.

How do I verify a webhook came from TrackPro?

Every webhook request is signed with HMAC-SHA256 using your endpoint secret and sent in the X-TrackPro-Signature header. Recompute the signature over the raw request body and compare it using a constant-time check before trusting the payload. Reject anything that does not match.

Is the API versioned, and how are changes handled?

The API is versioned in the URL path (/v1). We add fields and endpoints without bumping the version, and treat removals or breaking changes as a new version with advance notice. Webhook payloads carry an explicit type and a stable event id so you can build idempotent handlers.

Developer Platform

Build on the TrackPro API

The same REST API our own apps run on. Every vehicle, trip, alert, and geofence is addressable over HTTPS — pull live locations in under five seconds, or let signed webhooks push events to you the moment they happen.

Get API access Quickstart

GET /v1/vehicles/:id/location200 OK

{
  "vehicle_id": "veh_8h2k1m",
  "name": "Truck 042",
  "location": {
    "lat": 32.77662,
    "lng": -96.79699,
    "heading": 274,
    "speed_kph": 67,
    "accuracy_m": 3
  },
  "status": "moving",
  "driver_id": "drv_4c9t2e",
  "odometer_km": 81243.7,
  "recorded_at": "2026-06-10T14:32:08Z"
}

Getting started

From zero to first call in three steps

No SDK required. If you can send an HTTP request, you can build on TrackPro.

Request API access

API access is available on every paid plan. Talk to us or start a trial, then create an OAuth client and your first API key from Settings → Developer in the dashboard.

Make your first call

Authenticate with a bearer token and hit a read endpoint. Every account ships with sample vehicles so you can pull a live location before you connect a single tracker.

Subscribe to events

Register a webhook endpoint to receive geofence, alert, and maintenance events in real time — so you build on a push model instead of polling for changes.

Your first request

curl https://api.trackpro.live/v1/vehicles \
  -H "Authorization: Bearer $TRACKPRO_TOKEN"

Authentication

OAuth 2.0 and scoped keys

Server-to-server integrations use the OAuth 2.0 client-credentials flow to mint short-lived bearer tokens. For scripts and internal tools, scoped API keys work too — each key is bound to a set of scopes and recorded in a per-key audit log. All traffic is AES-256 encrypted in transit and at rest.

Least-privilege by design — grant only the scopes an integration needs
Rotate or revoke any key instantly; every call is attributable in the audit log
Tokens are short-lived; pass them as a Bearer credential

Available scopes

fleet:readRead vehicles, drivers, locations, trips, and assets.
fleet:writeCreate and update vehicles, drivers, and assets.
geofences:readList and inspect geofences and their membership.
geofences:writeCreate, edit, and delete geofences.
alerts:readRead alert definitions and triggered alert history.
webhooks:manageRegister, rotate, and delete webhook endpoints.

GET /v1/vehiclesauthenticated

curl https://api.trackpro.live/v1/vehicles \
  -H "Authorization: Bearer $TRACKPRO_TOKEN"

200 OK — list response

{
  "object": "list",
  "data": [
    { "vehicle_id": "veh_8h2k1m", "name": "Truck 042", "status": "moving" },
    { "vehicle_id": "veh_2p7r4x", "name": "Van 11",    "status": "idle"   }
  ],
  "has_more": true,
  "next_cursor": "veh_2p7r4x"
}

Core resources

Everything in your fleet, addressable

Resource-oriented endpoints with predictable URLs, JSON bodies, and cursor pagination.

ResourceMethodsDescription

Vehicles
/v1/vehicles
GETPOST
Vehicles, metadata, and current status across your fleet.
Locations
/v1/vehicles/:id/location
GET
Live position, heading, and speed — refreshed in under five seconds.
Trips
/v1/trips
GET
Completed and in-progress trips with distance, duration, and route.
Geofences
/v1/geofences
GETPOST
Define zones and read entry/exit events per vehicle.
Alerts
/v1/alerts
GET
Triggered alerts for speed, idling, fault codes, and more.
Drivers
/v1/drivers
GETPOST
Driver records, assignments, and identification.
Assets
/v1/assets
GETPOST
Non-powered assets — trailers, containers, and equipment.

GET /v1/vehicles/:id/location200 OK

curl https://api.trackpro.live/v1/vehicles/veh_8h2k1m/location \
  -H "Authorization: Bearer $TRACKPRO_TOKEN"

200 OK — location response

{
  "vehicle_id": "veh_8h2k1m",
  "name": "Truck 042",
  "location": {
    "lat": 32.77662,
    "lng": -96.79699,
    "heading": 274,
    "speed_kph": 67,
    "accuracy_m": 3
  },
  "status": "moving",
  "driver_id": "drv_4c9t2e",
  "odometer_km": 81243.7,
  "recorded_at": "2026-06-10T14:32:08Z"
}

Webhooks

Real-time events, pushed to you

Register an HTTPS endpoint and TrackPro will POST a JSON event the moment something happens — no polling. Every payload is signed with HMAC-SHA256 in the X-TrackPro-Signature header and carries a stable event id so your handlers can stay idempotent.

vehicle.locationA vehicle reported a new position.
geofence.enterA vehicle crossed into a geofence.
geofence.exitA vehicle left a geofence.
alert.triggeredAn alert rule fired (speed, idle, fault code…).
maintenance.dueA service interval came due for a vehicle.

POST to your endpoint — example payload

{
  "id": "evt_9f3k0a2c",
  "type": "geofence.enter",
  "created_at": "2026-06-10T14:32:09Z",
  "data": {
    "vehicle_id": "veh_8h2k1m",
    "geofence_id": "geo_depot_north",
    "geofence_name": "North Depot",
    "location": { "lat": 32.92140, "lng": -96.85710 },
    "occurred_at": "2026-06-10T14:32:08Z"
  }
}

Respond with a 2xx within a few seconds to acknowledge. TrackPro retries failed deliveries with exponential backoff.

Rate limits & pagination

Built for batch and burst

Rate limits

600 requests per minute per organization, with burst headroom for batch syncs. Every response carries X-RateLimit-Remaining and X-RateLimit-Reset; over the limit you get a 429 with a Retry-After header.

Cursor pagination

List endpoints accept a limit and a cursor. Responses include has_more and next_cursor — loop until has_more is false.

Paginate with a cursor

curl "https://api.trackpro.live/v1/trips?limit=50&cursor=trip_5m2k9p" \
  -H "Authorization: Bearer $TRACKPRO_TOKEN"

200 OK — paginated list

{
  "object": "list",
  "data": [
    { "vehicle_id": "veh_8h2k1m", "name": "Truck 042", "status": "moving" },
    { "vehicle_id": "veh_2p7r4x", "name": "Van 11",    "status": "idle"   }
  ],
  "has_more": true,
  "next_cursor": "veh_2p7r4x"
}

SDKs & tooling

REST today, SDKs on the roadmap

We are honest about where the platform is. The API and webhooks are production-ready now and language-agnostic; official client libraries are coming next.

Available now

REST API

Resource-oriented JSON over HTTPS. Works with any language, framework, or no-code tool that speaks HTTP.

Available now

Signed webhooks

HMAC-SHA256-signed event delivery with retries and a stable event id for idempotent processing.

On the roadmap

Language SDKs

Official JavaScript/TypeScript and Python clients, plus an OpenAPI spec, are planned to wrap the REST API.

Developer questions, answered

API access is included on every paid TrackPro plan. Once your account is active, an admin can create OAuth 2.0 clients and scoped API keys under Settings → Developer. If you want to evaluate the API first, start a 14-day trial or talk to us and we will set you up with sandbox credentials.

Get API access

Tell us what you are building and we will set you up with credentials, sandbox data, and a developer to talk to. API access is included on every paid plan.

Get API access