API & webhooks for Dashivo Pro fleets

Start in two minutes

1. In the console, open Company › API & webhooks and choose Create key. Name it for the system that will use it and tick what it may do. You confirm it's you, then the key is shown once: copy it to your server's secret settings.
2. Send it with each request:

curl https://pro.dashivo.app/api/public/v1/drivers \
  -H "Authorization: Bearer dshv_sampleprefix_…"

Every answer is JSON. An error looks like {"error": {"code": "insufficient_scope", "message": "…"}} with the HTTP status that fits it.

Keys and permissions

A key belongs to your company and works with its creator's authority. It stops at once when it's revoked, when it expires, or when the person who made it is no longer an Owner or Admin. We keep only a fingerprint of the key, never the key itself. Every key action and every data pull is written to Company security › Audit log (pulls as one line per key and hour, with the count), and the console lists the last requests of each key.

Endpoints

All under https://pro.dashivo.app/api/public/v1. The OpenAPI document describes every field.

Create a route from your orders

curl https://pro.dashivo.app/api/public/v1/routes \
  -H "Authorization: Bearer $DASHIVO_KEY" -H "Content-Type: application/json" \
  -d '{"name": "Order 1042", "driver_id": "…", "dispatch": true,
       "stops": [{"address": "100 Main St, Denver, CO", "note": "Ring twice"},
                 {"address": "200 Oak Ave, Denver, CO", "lat": 39.75, "lon": -104.97,
                  "window_start": "09:00", "window_end": "11:00", "dwell_minutes": 5}]}'

A stop without lat and lon is looked up by its address (up to 40 in one request); one we can't find is refused with address_not_found and its index, never guessed. With "dispatch": true the driver gets the route at once, exactly as if dispatch sent it from the console.

Lists, limits and errors

• Lists come newest first, 50 at a time (limit up to 200). When has_more is true, send next_cursor back as cursor. Most lists take since (an ISO 8601 time).
• Each key may make 120 requests a minute, 30 of them creating or dispatching routes. Every answer says how many are left (X-RateLimit-Remaining); over the limit you get 429 with Retry-After.
• 401: no key, a wrong one, or one revoked, expired or stopped. 403: the key lacks the permission. 402: your company's plan is read-only, so writes wait.

Webhooks

Add your server's HTTPS address in the console (or with POST /webhooks) and choose its events. We post a JSON message within seconds:

POST /your/endpoint
Dashivo-Event: stop.completed
Dashivo-Signature: t=1792857600,v1=5f2c…

{"id": "8c1d…", "type": "stop.completed", "created_at": "2026-10-24T15:20:04Z",
 "api_version": "2026-10-24", "organization_id": "…",
 "data": {"route": {"id": "…", "number": 1042, "name": "Order 1042"},
          "driver": {"id": "…", "name": "Jordan"},
          "stop": {"index": 0, "address": "100 Main St, Denver, CO", "lat": 39.741, "lon": -104.989},
          "proof_of_delivery": {"recipient_name": "Sam", "photo_urls": ["/api/public/v1/media/…"], "…": "…"}}}

Answer with any 2xx within 10 seconds. Anything else is tried again after 1 minute, 5 minutes, 30 minutes, 2, 6, 12 and 24 hours, then marked failed. The delivery log in the console shows each try and your server's answer, and can send one again. An endpoint where every delivery fails for 3 days is switched off until you turn it back on. A retry can arrive twice, so use the event's id to skip repeats. Addresses must be public HTTPS; we don't follow redirects.

Check a signature

Each endpoint has its own signing secret, shown once when you add it. v1 is an HMAC-SHA256 of the timestamp, a dot and the raw body. Compare it in constant time and refuse old messages:

import hashlib, hmac, time

def verify(secret: str, body: bytes, header: str, tolerance=300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t = int(parts["t"])
    if abs(time.time() - t) > tolerance:
        return False
    mac = hmac.new(secret.encode(), f"{t}.".encode() + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(mac, parts["v1"])

const crypto = require("crypto");
function verify(secret, rawBody, header, tolerance = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > tolerance) return false;
  const mac = crypto.createHmac("sha256", secret).update(`${parts.t}.`).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(mac), Buffer.from(parts.v1));
}

Zapier

The API is ready for Zapier: triggers subscribe with POST /webhooks and unsubscribe with DELETE /webhooks/{id}, and GET /me tests the connection. Our Zapier app is coming soon, with these triggers and actions:

• Triggers: Stop completed, Stop skipped, Route accepted, Route declined, New alert, Crash detected, Police stop started, Inspection failed, Event video ready.
• Actions: Create route (and dispatch it), Dispatch route. Search: Find driver by email.

Until then, Zapier's own Webhooks step can receive any of our events today.