Put an order in from your own system.

Endpoints

Six, all live. Nothing on this page is planned or partial.

• GET/pingCheck a key and see its scopes
• GET/ordersList orders — filter by status and created_after, paged
• POST/ordersCreate an order, single- or multi-stop
• GET/orders/{id}One order
• GET/orders/{id}/trackingPositions of the truck carrying it
• GET/orders/{id}/documentsProof of delivery and other documents, as 24-hour signed URLs

Authentication

Send your key as a bearer token, or in an X-API-Key header. A key belongs to exactly one company, and every response is scoped to it.

• Scopes are per key: orders:read, orders:write, tracking:read, documents:read. Give an integration the least it needs.
• We store only a SHA-256 of the key. It cannot be read back — issue a new one if it is lost.
• 120 requests per key per minute.
• Every call is logged with a request id, returned in the body and in the X-Request-Id header. Quote it and we can find the call.

Webhooks

So your system does not have to poll. We call you when something happens, from whichever side caused it — a dispatcher in the TMS, a carrier in the Partner HUB, a driver in the app, or a call to this API.

• EVENTorder.status_changedAn order moved along the status machine
• EVENTorder.pod_uploadedA proof of delivery arrived
• EVENTinvoice.issuedAn invoice was issued

Every delivery carries three headers. The signature is an HMAC-SHA256 over the timestamp and the raw body, using the signing secret shown once when you create the endpoint.

X-Cargon-Signature: t=1788700000,v1=5f2b...c91a
X-Cargon-Event:     order.status_changed
X-Cargon-Delivery:  4417

Verify against the RAW body, before any JSON parsing. Re-serialising changes bytes and the signature will not match. The timestamp is inside the signed string so a captured delivery cannot be replayed later — reject anything older than five minutes.

Any 2xx means delivered. Anything else, or no answer within ten seconds, is retried five times with growing gaps:

1 min  →  5 min  →  15 min  →  1 h  →  6 h

So your system can be down for most of a day and still receive everything. After that the delivery is marked failed and stays in the log; re-enabling the endpoint replays what was missed. An endpoint that fails twenty times in a row is switched off rather than hammered, and you are told why.

Telematics

Truck positions reach the TMS either by us polling a provider, or by your system pushing them to us.

Traccar testedWebhook / Push API tested Wialon integration readyWebfleet integration readySamsara integration readyGeotab integration readyNavixy integration readyMapon integration readyflespi integration readyVerizon Connect integration ready

“Tested” means we drove a real account end to end. “Integration ready” means the adapter is written and reaches the provider, but no customer account has certified it yet — tell us which one you use and we will certify it with you.

Get a key

Keys live in your own account under Settings → API keys. If you are evaluating and do not have an account yet, start a trial — no card needed.

Sign in and create a key →