GPS tracking API and webhooks
Connect Posiway location operations to your own applications through REST APIs and event-driven webhooks. Common destinations include ERP, CRM, TMS, dispatch, billing, analytics, mobile apps, customer portals, and control-room screens.
REST API and OpenAPI
The interactive API reference describes documented endpoints, authentication, parameters, request examples, and response schemas. The OpenAPI specification can be used by code generators, API clients, testing tools, and AI development agents.
Event-driven webhooks
Webhooks deliver hardware and business alarm events to a customer-controlled endpoint. Each request includes an event ID, event type, timestamp, signature version, and HMAC-SHA256 signature.
Consumers should:
- Preserve the raw JSON request body for signature verification.
- Rebuild the signing payload from timestamp, event ID, and raw body.
- Compare signatures securely.
- Deduplicate with the event ID.
- Return a 2xx response for accepted and previously processed events.
- Move long-running business work to an asynchronous queue.
See the Webhook API guide for retry and receiver details and Alarm Webhook Events for event types and payloads.
Integration design checklist
- Define data ownership and account scope.
- Request the minimum required API permissions.
- Protect credentials and rotate them under an agreed policy.
- Set connection and request timeouts.
- Handle rate limiting, retries, pagination, and partial failures.
- Monitor webhook latency, signature failures, duplicates, and dead-letter events.
- Keep raw payloads only as long as required by security and compliance policy.
Frequently asked questions
Does Posiway provide an OpenAPI specification?
Yes. A machine-readable OpenAPI JSON document and an interactive browser reference are available on the Posiway documentation site.
How are Posiway webhooks signed?
Webhooks use an HMAC-SHA256 signature built from the timestamp, event ID, and raw request body.
How should webhook duplicates be handled?
Consumers should use the event ID as an idempotency key and return a 2xx response when an event was already processed successfully.