إنتقل إلى المحتوى الرئيسي

Changelog

30 Oct 2026: webhooks and alert wording​

  • Every public event can be subscribed to: device, vehicle and driver lifecycle, trips, crashes, tolls, tachograph, screening, maintenance, tires, trailers, secure trips, fuel drains and connector payments join the alerts, geofences, dispatch, hours of service and fuel events. The event catalogue lists them with their schema version; GET /v1/webhooks/events adds each one's JSON Schema and a sample.
  • Test any event: POST /v1/webhooks/{id}:test takes {"event": "<name>"} and sends that event's sample; a test carries "test": true and X-Zaitrack-Test: true. See Test a subscription.
  • Secret rotation with an overlap: secrets:rotate takes overlapHours (0 to 168, 24 by default); during it the old secret signs beside the new one, as a second v1.
  • Dead letters across subscriptions: GET /v1/webhooks/dead-letters and POST /v1/webhooks/dead-letters:replay (up to 100 at once).
  • Division filter: filters.divisionIds keeps events about vehicles of those divisions and the divisions below.
  • Attempts record headers: each attempt of a delivery shows the request headers sent and your endpoint's response headers.
  • Alerts say what happened language-neutral: every alert from GET /v1/alerts and GET /v1/alerts/{id}, and the data of zaitrack.alert.raised.v1, now carries code and params beside its English title. Show alerts in your users' language from them. The webhook's data also carries the alert's description. Additive: no field changed. See Alert wording.

28 Oct 2026: public API v1​

The first public API. Everything in it is served today.

  • 148 operations at https://api.zaitrack.app/v1/: vehicles and asset classes, drivers, devices, device classes and codecs, positions and tracks, trips, geofences and their visits, alerts and alert rules, webhooks and their deliveries, dispatch jobs and stops, device commands, fuel cards, transactions, tanks and levels, maintenance plans, work orders and inspections, reports and schedules, API keys, personal access tokens and the marketplace catalogue. See the API reference.
  • Credentials: organisation API keys (zk_live_, zk_test_), personal access tokens (zpat_) and OAuth apps through auth.zaitrack.app. A credential never carries a scope its creator lacks; <family>:* covers a family's actions. See Authentication.
  • Developer Studio at developer-studio.zaitrack.app: API keys and their use, OAuth apps, webhooks and their deliveries, up to three sandboxes, and the rate limits.
  • Sandboxes: test keys reach only a sandbox; live keys never do.
  • Gateway behaviour: rate classes per organisation and operation, Idempotency-Key replay for 24 hours, audited writes, step-up MFA for device commands, RFC 9457 problems.
  • Regions: api.zaitrack.app sends each request to the organisation's region; GCC organisations are served from gcc. See Regions.
  • Webhooks: 12 events, HMAC-SHA256 signatures with a 15-minute window, retries with backoff, dead letters and replay. See Webhooks.

Not in v1: a published SDK, GraphQL or gRPC for third parties, streaming positions, and running third-party adapter code.

What this page records​

Each change to the public API's operations, credentials, limits or events, on the day it is served.