Changelog

​

Deprecation policy

1. A deprecation notice is added to this changelog and to the relevant endpoint reference page.
2. The live API begins returning a Sunset HTTP response header (RFC 8594) on every call to the deprecated route, with the removal date as an HTTP-date value:
   Sunset: Sat, 14 Oct 2026 23:59:59 GMT
   
3. The endpoint continues to work for a minimum of 6 months from the deprecation notice date.
4. After the Sunset date the route may return 410 Gone or be removed entirely.

​

API versioning

X-API-Version: 2

​

Version history

​

2026-04-28 — API V2 release

​

Added

• Rate limiting middleware — 60 requests per 60-second sliding window per token; returns 429 with Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset headers
• Exception middleware — all V2 errors return a standardised ApiError JSON body (type, code, description, requestId, docUrl)
• X-API-Version: 2 response header on all V2 responses

• POST /api/v2/authentication/token/user — V2 user login
• POST /api/v2/authentication/token/api-key — V2 API key login

• GET /api/v2/companies — paginated list of accessible companies
• GET /api/v2/companies/{id}/vehicles/last-position — paginated fleet-wide last positions
• GET /api/v2/companies/{id}/vehicles/nearest — nearest vehicles to a coordinate (paginated)
• GET /api/v2/companies/{id}/vehicles/last-time-online — paginated fleet last-seen timestamps
• GET /api/v2/companies/{id}/alert-records — paginated alert records
• GET /api/v2/companies/{id}/alerts — new — paginated alert configurations with string AlertType and linked vehicle/tag lists
• PUT /api/v2/companies/{id}/set-all-alerts-read — mark all company alert records as read

• POST /api/v2/vehicles/list — paginated vehicle list
• GET /api/v2/vehicles/{id}/last-position — last known position for a vehicle
• GET /api/v2/vehicles/{id}/positions — paginated position history
• GET /api/v2/vehicles/info — new — look up vehicle metadata by IMEI, vehicle ID, or VIN
• GET /api/v2/vehicles/{id}/last-online — last-seen timestamp for a vehicle
• GET /api/v2/vehicles/{imei}/device-ids — IMEI → vehicle ID lookup
• GET /api/v2/vehicles/{id}/engine-codes — enriched — paginated engine codes with AI analysis, severity, and detection location

• PUT /api/v2/vehicles/{id}/odometer — update odometer
• PUT /api/v2/vehicles/{id}/name — rename vehicle
• PUT /api/v2/vehicles/{id}/position/refresh — trigger location refresh
• POST /api/v2/vehicles/{id}/ignition — send ignition command
• PUT /api/v2/vehicles/{id}/door-lock — send door lock/unlock command

• PUT /api/v2/alerts/{id}/{date}/update-read-status — new — mark a single alert record as read or unread

• GET /api/v2/replay/{id} — paginated trip replay

• GET /api/v2/safety-score/{id} — trip safety score
• GET /api/v2/battery-health — paginated battery health predictions

• POST /api/v2/webhooks — create a webhook; response includes the plaintext HMAC secret (returned once only)
• GET /api/v2/webhooks/{id} — get a webhook by ID
• GET /api/v2/webhooks — paginated list of company webhooks
• PUT /api/v2/webhooks/{id} — update webhook URL, active state, or linked alerts
• DELETE /api/v2/webhooks/{id} — soft-delete a webhook
• POST /api/v2/webhooks/{id}/link-alert — link an alert configuration to a webhook

​

2026-04-28 — GetSafetyScore parameter updates

​

Changed

• POST /api/GetSafetyScore — vehicleId parameter renamed from id (breaking for clients using the old name)
• POST /api/GetSafetyScore — start and finish are now optional; omit both and supply intervalType to use a preset time window
• POST /api/GetSafetyScore — new intervalType parameter: 1 = instant range, 2 = relative to end of local day, 3 = three-day window, 4 = week window. Validate preset windows in staging before relying on them (see endpoint reference for the known date-arithmetic quirk)

​

2026-04-14 — v1 (Initial public documentation)

​

Added

• POST /api/Authentication/token/user — JWT via username + password
• POST /api/Authentication/token/api-key — JWT via API key (GUID)

• POST /api/GetCompanies — list accessible companies
• POST /api/GetAllLastPositionData/{companyId} — fleet-wide last positions
• POST /api/GetNearestVehicles — nearest vehicles to a coordinate
• POST /api/devices — vehicle list for a company
• POST /api/GetAllLastTimeOnline — last-seen timestamps for all vehicles

• POST /api/GetLastPositionData — latest position for one vehicle
• POST /api/GetPositionData — historical positions for one vehicle
• POST /api/GetReplay — trip replay (UTC time context)
• POST /api/GetReplayUserTime — trip replay (user timezone context)
• GET /api/GetDeviceId — IMEI → legacy vehicle id lookup

• POST /api/GetAlerts — list alerts for a company
• POST /api/SetAlertAsRead — mark one alert as read
• POST /api/SetAllAlertAsRead — mark all company alerts as read

• POST /api/GetCompanyVehiclesBatteryHealth — paged battery predictions
• POST /api/GetSafetyScore — trip safety score for a vehicle
• GET /api/devices/{id}/dtc-codes — latest DTC codes from vehicle handler state

• POST /api/ChangeOdometer — update odometer value
• POST /api/SetVehicleName — rename a vehicle
• POST /api/UpdateLocation — trigger device location update
• POST /api/SendIgnition — send ignition enable/disable command
• POST /api/LastTimeOnline — last-seen timestamp for one vehicle
• POST /api/SendDoorLock — send door lock command (ATrack SMS path)

• POST /api/Test — anonymous connectivity health check

​

Deprecated

• POST /api/rebuild-vehicle-movement-cache — removed from public API reference (internal dev/ops only; not for integration partners).