Getting started

Before you start

You need an API key for your company. Someone at your company with portal access creates it on the API keys page and shares the key and secret with you — your integration never signs in.

Each key is scoped to specific APIs, so ask for one scoped to the endpoints you actually call. A narrowly scoped key is safer and easier to replace than one that can reach everything.

Check connectivity

No credentials needed, so this verifies reachability first:

curl https://YOUR_HOST/health

{"status":"ok"}

Your first request

Send the key and secret as a single Authorization header on every call. Here are one day’s tasks:

curl -sS 'https://YOUR_HOST/v1/tasks?date=2026-03-20' \
  -H 'Authorization: apiKey:apiSecret'

Responses share the same envelope:

{
  "success": true,
  "numTasks": 2,
  "tasks": [
    {
      "taskId": "…",
      "userName": "…",
      "truckNumber": "114",
      "loadCount": 6,
      "startTime": "2026-03-20T13:02:11.000Z",
      "jobName": "…",
      "status": "…"
    }
  ]
}

You never pass a company identifier. Requests are scoped to the company that issued your key, so you only ever see your own data.

When something goes wrong

Errors return the same shape — a code and a human-readable message.

• 400 — a parameter is missing or malformed. The message names the parameter.
• 401 — the key or secret is wrong, or the key was revoked. Check the header format first.
• 403 — your key is valid but not allowed to make this call. The message says which of two reasons applies: the key is not scoped to this API, which whoever manages your keys can change, or your company is not approved for it, which needs Iron Sheepdog Support.
• 5xx — a failure on our side. Retry with backoff; if it persists, contact Support with the time of the request.

Things worth knowing

• Dates are UTC. A date parameter means a UTC calendar day, so a request near midnight may not match your local day.
• Lists are paged, never truncated. A response carries hasMore and nextCursor. Keep requesting with the cursor until hasMore is false — a full page on its own does not mean you have everything.
• One key per integration. Scope each key to just the APIs that integration calls, so it can be rotated or revoked without disrupting the rest — and a leaked one reaches less.

Next steps

The developer documentation has the full endpoint reference, request and response shapes, and a panel for trying each endpoint live in the browser. A machine-readable OpenAPI description is at /openapi.json for generating clients.